@jamesklassen
I think it should work. Check this.
| makeresults count=3 | eval diff=100 | accum diff | eval _time= _time + diff, User="user2",Server="Server".(diff/100), State="Disconnected",Data="blahblahblah" | append [ | makeresults count=3 | eval diff=300 | accum diff | eval _time= _time + diff, User="user3",Server="Server".(diff/300), State="Disconnected",Data="blahblahblah" ] | append [| makeresults count=1 | eval _time= _time + 450| eval User="user1",Server="Server2", State="Connected",Data="blahblahblah"] | sort _time | table _time Server User State Data | stats latest(_time) as _time latest(*) as * by User | where State="Disconnected"
Can you please share more details about in which scenario it is not working?? You can enhance your provided data set also for same.
... View more