I've found the stat functions 'earliest' and 'latest' work best for time-dependent field reporting:
... | stats latest(_time) as _time, latest(X)
Sorry that I wasn't more specific. I want to grab data from the previous hour, and I want to get the value of the last event, along with the timestamp associated with that last event. I'll try these, but I'm don't think they are what I'm looking for...
I think you are looking for:
| head 1
| addinfo
The time the search was executed will be in the info_search_time field
You can also get the most recent value of a particular field using the "first" function in stats:
... | stats first(X)
This would get you the latest result:
... | head 1
Not sure if that's what you want, hard to guess from the question.