New comment on reddit

You may need to mvexpand those fields thusly:

index=os_monitoring sourcetype=os:monitoring:netstat earliest=@d | search NOT [ search index=os_monitoring sourcetype=os:monitoring:netstat earliest=-1d@d latest=@d | stats values(Port) as Port by host | mvexpand Port ] | stats values(Port) as portsNotYesterday max(_time) as currentTime by host 

Sidebar: max(_time) is faster than latest(_time) – and always yields the value you're expecting 🙂