<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to display the rows which has one single value more than 2 in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460071#M33032</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;I have a query which displays the resultset as below,&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8945i2270209C8F5424C2/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;I would like to get the Module which has gone more than 2s in any of the month. In the above screenshot, I need DocumentExchange to be resulted since it exceeded one of the month more than 2 s.&lt;/P&gt;
&lt;P&gt;How do I achieve this? I tried to do &lt;CODE&gt;| foreach *2020 [convert num(&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;) as &amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt; | search &amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;&amp;gt;2]&lt;/CODE&gt; But this results Module which were more than 2s in all the three months. How do i rewrite the query so that it lists Module which exceeds 2s even in any one of the month?&lt;/P&gt;
&lt;P&gt;Please advise.&lt;BR /&gt;Thanks&lt;/P&gt;
&lt;P&gt;using Max brings the max of fieldname and not the value&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="![alt text][2]"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8946i17DB75A96930D143/image-size/large?v=v2&amp;amp;px=999" role="button" title="![alt text][2]" alt="![alt text][2]" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Sun, 07 Jun 2020 23:54:41 GMT</pubDate>
    <dc:creator>sangs8788</dc:creator>
    <dc:date>2020-06-07T23:54:41Z</dc:date>
    <item>
      <title>How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460071#M33032</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;I have a query which displays the resultset as below,&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8945i2270209C8F5424C2/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;I would like to get the Module which has gone more than 2s in any of the month. In the above screenshot, I need DocumentExchange to be resulted since it exceeded one of the month more than 2 s.&lt;/P&gt;
&lt;P&gt;How do I achieve this? I tried to do &lt;CODE&gt;| foreach *2020 [convert num(&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;) as &amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt; | search &amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;&amp;gt;2]&lt;/CODE&gt; But this results Module which were more than 2s in all the three months. How do i rewrite the query so that it lists Module which exceeds 2s even in any one of the month?&lt;/P&gt;
&lt;P&gt;Please advise.&lt;BR /&gt;Thanks&lt;/P&gt;
&lt;P&gt;using Max brings the max of fieldname and not the value&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="![alt text][2]"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/8946i17DB75A96930D143/image-size/large?v=v2&amp;amp;px=999" role="button" title="![alt text][2]" alt="![alt text][2]" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Sun, 07 Jun 2020 23:54:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460071#M33032</guid>
      <dc:creator>sangs8788</dc:creator>
      <dc:date>2020-06-07T23:54:41Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460072#M33033</link>
      <description>&lt;P&gt;@sangs8788, Try below for each command to get maximum value then compare it with 2.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...|  foreach *2020
   [ eval max = max('&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;') ]|where max&amp;gt;2
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 19 May 2020 11:54:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460072#M33033</guid>
      <dc:creator>493669</dc:creator>
      <dc:date>2020-05-19T11:54:18Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460073#M33034</link>
      <description>&lt;P&gt;That works. Thanks&lt;/P&gt;</description>
      <pubDate>Tue, 19 May 2020 12:06:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460073#M33034</guid>
      <dc:creator>sangs8788</dc:creator>
      <dc:date>2020-05-19T12:06:12Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460074#M33035</link>
      <description>&lt;P&gt;@493669 &lt;/P&gt;

&lt;P&gt;It is not providing the max value instead for all the rows it takes max of fields name and not field value.&lt;/P&gt;</description>
      <pubDate>Tue, 26 May 2020 07:02:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460074#M33035</guid>
      <dc:creator>sangs8788</dc:creator>
      <dc:date>2020-05-26T07:02:21Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460075#M33036</link>
      <description>&lt;P&gt;provide your sample data ,what is expected result and what it is returning using above query.&lt;/P&gt;</description>
      <pubDate>Tue, 26 May 2020 07:05:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460075#M33036</guid>
      <dc:creator>493669</dc:creator>
      <dc:date>2020-05-26T07:05:17Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460076#M33037</link>
      <description>&lt;P&gt;I have updated my query with the screenshot. As you can see, Mar-2020 is taken as the max field &lt;/P&gt;</description>
      <pubDate>Tue, 26 May 2020 07:39:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460076#M33037</guid>
      <dc:creator>sangs8788</dc:creator>
      <dc:date>2020-05-26T07:39:38Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460077#M33038</link>
      <description>&lt;P&gt;Try this-&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...| foreach *2020 
    [ eval Max=case(Max&amp;gt;='&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;',Max,true(),'&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;') ]
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 26 May 2020 08:26:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460077#M33038</guid>
      <dc:creator>493669</dc:creator>
      <dc:date>2020-05-26T08:26:01Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460079#M33040</link>
      <description>&lt;P&gt;ok you are doing a compare of the max with each and every field. Got it. This should ideally work.&lt;/P&gt;</description>
      <pubDate>Tue, 26 May 2020 08:45:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460079#M33040</guid>
      <dc:creator>sangs8788</dc:creator>
      <dc:date>2020-05-26T08:45:17Z</dc:date>
    </item>
    <item>
      <title>Re: How to display the rows which has one single value more than 2</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460080#M33041</link>
      <description>&lt;P&gt;This Works. Thanks a lot&lt;/P&gt;</description>
      <pubDate>Tue, 26 May 2020 08:53:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-the-rows-which-has-one-single-value-more-than-2/m-p/460080#M33041</guid>
      <dc:creator>sangs8788</dc:creator>
      <dc:date>2020-05-26T08:53:49Z</dc:date>
    </item>
  </channel>
</rss>

