Hello dear Community! I have a set of separate machines logging number of different events to Splunk, each group can be identified by some unique 'RunId' field. Each machine send event multiple times per day. Via the some simple 'table' query I can display all collected info on the Dashboard, like ``` index=idx1 sourcetype=machines_monitoring | table RunId, MachineName, Environment, Version, State ``` Now I have a lot of raws displayed for each machine with the different information about the each machine's state. How can I filter the events to have the table showing only the current state of each machine, without duplicates, using only the latest group of events sent by each machine? I've tried 'latest(RunId) by RunId, MachineName, Environment, Version, State` with no changes, all duplicated values are displayed as usual. ... View more