New comment on reddit

index=box doc_visitbility=* | fields _time doc_visibility owner | eval doctime=doc_visibility+"|"+_time | stats values(doctime) as doctime by owner | eval doctime=mvindex(doctime,-1) | search doctime="Public*" | rex field=doctime "(?<docviz>[^|]+)|(?<when>\d+)" | sort - when owner | table docviz when owner | eval when=strftime(when,"%c") 

I've had times when I have to do what you're describing, and have tried things like what u/Steeliie suggested, but didn't work for some strange reason or other (we have some seriously wonky data at times with some of my customers).

So I use the combine-stats-separate method above.

Works every time 🙂