https://community.splunk.com/t5/Splunk-Search/How-to-get-the-field-name-of-the-maximum-value-of-several-fields/m-p/392681#M114227 <P>It would be helpful to have some context on what your end goal is, but what you're describing is possible by just doing something like this:</P> <PRE><CODE>index=_internal source=*metrics* | fieldsummary | sort - max | head 1 | fields field max </CODE></PRE> <P>or</P> <PRE><CODE>index=_internal source=*metrics* | fieldsummary | stats max(max) as max by field | sort - max </CODE></PRE> Thu, 14 Jun 2018 23:37:37 GMT masonmorales 2018-06-14T23:37:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-field-name-of-the-maximum-value-of-several-fields/m-p/392680#M114226 <P>I have data that has several fields. I want to compare the fields to find the max value of them, which I can do via <BR /> <CODE>| eval maximum=max(field1, field2, field3)</CODE></P> <P>However, I also want to return the field name of the value that is the highest. Is there a simple function that does this?</P> Thu, 14 Jun 2018 21:52:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-field-name-of-the-maximum-value-of-several-fields/m-p/392680#M114226 brajaram 2018-06-14T21:52:00Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-field-name-of-the-maximum-value-of-several-fields/m-p/392681#M114227 <P>It would be helpful to have some context on what your end goal is, but what you're describing is possible by just doing something like this:</P> <PRE><CODE>index=_internal source=*metrics* | fieldsummary | sort - max | head 1 | fields field max </CODE></PRE> <P>or</P> <PRE><CODE>index=_internal source=*metrics* | fieldsummary | stats max(max) as max by field | sort - max </CODE></PRE> Thu, 14 Jun 2018 23:37:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-field-name-of-the-maximum-value-of-several-fields/m-p/392681#M114227 masonmorales 2018-06-14T23:37:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-field-name-of-the-maximum-value-of-several-fields/m-p/392682#M114228 <P>After sorting . pipe the result to "|head 1" to display just the one row you are interested in.</P> Fri, 05 Oct 2018 20:35:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-field-name-of-the-maximum-value-of-several-fields/m-p/392682#M114228 sunilsk1 2018-10-05T20:35:48Z