> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/latest.md).

# latest

Use the latest() function within a comp or windowcomp stage to retrieve the single chronologically latest value for a specified field within each group of rows.

## Syntax

```sql
comp latest(<field>) [as <alias>] [by <field1>[, <field2>...]] [addrawdata = true|false [as <target field>]]
```

## Parameters

| Name           | Type                       | Required | Description                                                                                      |
| -------------- | -------------------------- | -------- | ------------------------------------------------------------------------------------------------ |
| field          | string, numeric, timestamp | Yes      | The field from which you want to retrieve the chronologically latest value.                      |
| alias          | string                     | No       | An optional name for the output column.                                                          |
| field1, field2 | string, numeric, boolean   | No       | Optional fields used to group rows; the latest value is calculated independently for each group. |
| addrawdata     | boolean                    | No       | When set to true, includes a column listing the raw events contributing to the aggregate result. |

## Returns

The latest() function returns a single value representing the chronologically latest entry for the specified field within its window or partition.

## Usage Notes

* This function requires the dataset to contain a time-related field (such as \_time) to be considered valid for chronological evaluation.
* When used with the comp stage, system fields like \_time are removed from the result set unless explicitly included in the by clause.
* The order of selection depends entirely on the chronological order of events.
* If you utilize the addrawdata = true option, the query will process up to 50 defined fields and display up to 100 contributing events.

## Examples

### Example 1: Find the latest event ID across the entire dataset

**Goal**: Identify the ID of the most recent event recorded in the dataset.

**XQL Code**:

```sql
config timeframe = 1d  
| dataset = sample_xql_raw  
| comp latest(event_id) as latest_event_id
```

**Explanation**: This query scans the sample\_xql\_raw dataset for the last 24 hours and identifies the event\_id of the record with the most recent timestamp.

**Output**:

| LATEST\_EVENT\_ID |
| ----------------- |
| 110               |

### Example 2: Find the latest log entry grouped by success status

**Goal**: Retrieve the most recent raw log data separately for successful and unsuccessful events.

**XQL Code**:

```sql
config timeframe = 1d  
| dataset = sample_xql_raw  
| comp latest(raw_log_data) as latest_raw_log by is_successful
```

**Explanation**: The query partitions the data into groups based on the is\_successful status and retrieves the chronologically latest raw\_log\_data for each group.

**Output**:

| IS\_SUCCESSFUL | LATEST\_RAW\_LOG                              |
| -------------- | --------------------------------------------- |
| true           | "Full backup of prod\_db to S3 completed."    |
| false          | "Client C2 hit rate limit on /data endpoint." |

## Related Articles

* **Stages**: [comp](/xql-command-reference-guide/readme/stages/comp.md), [windowcomp](/xql-command-reference-guide/readme/stages/windowcomp.md), [config](/xql-command-reference-guide/readme/stages/config.md), [dataset](/xql-command-reference-guide/readme/stages/dataset.md)
* **Functions**: [earliest()](/xql-command-reference-guide/readme/functions/earliest.md), [first()](/xql-command-reference-guide/readme/functions/first.md), [last()](/xql-command-reference-guide/readme/functions/last.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xql-command-reference-guide/readme/functions/latest.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.