I have the following query index=qa sourcetype=xxx (JobName =xxxx) ClassName=xxxx | dedup buildNum, jobName, TestName | streamstats global=f current=f window=1 first(buildNum) as priorBuildNum, first(Status) as priorStatus by jobName, TestName | stats latest(Status) as currentStatus by buildNum,TestName |table buildNum, TestName , currentStatus I have 1st three columns with the above query . I want to compute the LastPassedBuildNum column ( I have added expected results) Logic would be : if currentStatus is Success --> get the buildNum and display that, if currentStatus is Error --> get the most recent buildNum when test was Success buildNum TestName currentStatus Last PassedbuildNum 4532 TestName1 Success 4532 4532 TestName2 Error 4531 (assume) 4533 TestName1 Success 4533 4533 TestName2 Error 4531(assume) 4534 TestName1 Error 4533 (should be most recent passed buildNum) 4534 TestName2 Success 4534 Could someone help me compute the last column in above table? I used foreach too but for some reason, i have not been able to get the desired result Thanks! ... View more