You can use something like below Index=*  earliest=-1w@w6 latest=now() | search errors*  ... View more

There are pre-req's that are required to have the correct knowledge objects for Windows Infrastructure app. If these are not on the same Search Head as the windows infrastructure app it will give you those errors. http://docs.splunk.com/Documentation/MSApp/1.3.0/MSInfra/Platformandhardwarerequirements#The_Splunk_... The Splunk Add-ons for Microsoft Active Directory and Windows DNS v1.0.0 or later The suite of Splunk Add-ons for Active Directory must be installed on universal forwarders in the Windows deployment. You can download the Splunk Add-ons for Microsoft Active Directory and Windows DNS from Splunkbase. Please refer the original post for more info on this https://community.splunk.com/t5/All-Apps-and-Add-ons/Message-quot-Eventtype-wineventlog-ds-does-not-exist-or-is/m-p/278473   ... View more

If you are getting these results from stats. You can try using latest function like below. However, it would be easier to address your question if you can share how you got this result. |stats latest(queue) values(value) by some_other_field ... View more