New comment on reddit

You need to flip the order or your stats'ing (or include the extra fields)

Once you've stats'd, you've lost whatever fields you didn't include

Here's a possible update:

sourcetype=projects | stats latest(project_id) by project_partner_1, project_partner_2 event results | search project_id IN ("11234", "21244", "24322", "34435") | stats count by project_id, project_partner_1, project_partner_2, event, results 

…Or you could investigate join – but when you can, you should avoid it 🙂

September 02, 2020 at 12:45PM
via reddit https://www.reddit.com/r/Splunk/comments/il9o4o/need_to_take_particular_results_of_the_first/g3qkr9z?utm_source=ifttt