topic Re: How to find maximum value in Splunk Enterprise

How to find maximum value

Azwaliyana — Wed, 08 Dec 2021 03:45:59 GMT

I want to display the maixmum percentage and the mounted but I do not know the command.
because the file is not in csv. It is a txt file and I use multikv to extract the field.

Re: How to find maximum value

bowesmana — Wed, 08 Dec 2021 05:08:17 GMT

Can you give an example of the data you have

Re: How to find maximum value

Azwaliyana — Wed, 08 Dec 2021 06:57:30 GMT

Re: How to find maximum value

Azwaliyana — Thu, 09 Dec 2021 00:53:12 GMT

@bowesmana I have replied above

Re: How to find maximum value

ITWhisperer — Thu, 09 Dec 2021 04:30:51 GMT

Please can you share as text in a code block </> rather than an image?

Re: How to find maximum value

Azwaliyana — Fri, 10 Dec 2021 01:15:56 GMT

fs-3 | CHANGED | rc=0 >> Filesystem Size Used Avail Use% Mounted on devtmpfs 16G 4.0K 16G 1% /dev tmpfs 16G 16K 16G 1% /dev/shm tmpfs 16G 1.6G 15G 10% /run tmpfs 16G 0 16G 0% /sys/fs/cgroup /dev/mapper/rhgs-root 23G 8.3G 15G 37% / /dev/vda1 1014M 91M 924M 9% /boot

@ITWhisperer @bowesmana

Re: How to find maximum value

ITWhisperer — Fri, 10 Dec 2021 06:36:19 GMT

| multikv forceheader=2 | eval Use_ = rtrim(Use_,"%") | chart max(Use_) by Mounted