https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403421#M116735 <P>Thank you. It is another one good solution. Works correctly. My awards for you</P> Sat, 12 Jan 2019 07:42:31 GMT kvaga 2019-01-12T07:42:31Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403415#M116729 <P>Hello!<BR /> I have a table like this</P> <PRE><CODE>ID, OperationName, Duration 1, oper_x, 114 2, oper_x, 117 3, oper_c, 76 4, oper_z, 87 5, oper_c, 76 6, oper_z, 128 </CODE></PRE> <P>I want to show ID and OperationName which have max Duration. For example:</P> <P>ID, OperationName, Duration<BR /> 2, oper_x, 117<BR /> 3, oper_c, 76<BR /> 6, oper_z, 128</P> <P>Please help me. How can I do it? I tried ti use eventstat for max value searching grouped by OperationName. But can't show corresponding ID value</P> Tue, 29 Sep 2020 22:45:10 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403415#M116729 kvaga 2020-09-29T22:45:10Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403416#M116730 <P>can you try something like this:</P> <PRE><CODE>|eventstats max(Duration) as max_opp_duration by OperationName|where max_opp_duration=Duration </CODE></PRE> <P>this will give you two rows for oper_c, since ID 3 and 5 have the same duration. you could add <CODE>min(ID) as min_opp_id</CODE> to the eventstats and then add <CODE>AND min_opp_id=ID</CODE> to the where statement</P> Tue, 29 Sep 2020 22:41:46 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403416#M116730 cmerriman 2020-09-29T22:41:46Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403417#M116731 <P>Is this the answer?</P> <PRE><CODE> | stats max(Duration) by ID, OperationName </CODE></PRE> Fri, 11 Jan 2019 19:55:31 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403417#M116731 jkat54 2019-01-11T19:55:31Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403418#M116732 <P>Thank you very much! It is exactly what I need!</P> Fri, 11 Jan 2019 20:11:19 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403418#M116732 kvaga 2019-01-11T20:11:19Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403419#M116733 <P>Unfortunately, no. Since ID is unique then you will have huge amount of pairs ID, OperationName</P> Fri, 11 Jan 2019 20:21:49 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403419#M116733 kvaga 2019-01-11T20:21:49Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403420#M116734 <P>Like this:</P> <PRE><CODE>| makeresults | eval raw="1 oper_x 114:::2 oper_x 117:::3 oper_c 76:::4 oper_z 87:::5 oper_c 76:::6 oper_z 128" | makemv delim=":::" raw | mvexpand raw | rename raw AS _raw | rex "^(?&lt;ID&gt;\S+)\s+(?&lt;OperationName&gt;\S+)\s+(?&lt;Duration&gt;\S+)" | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | sort 0 - Duration | dedup OperationName | sort 0 ID </CODE></PRE> Fri, 11 Jan 2019 20:35:14 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403420#M116734 woodcock 2019-01-11T20:35:14Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403421#M116735 <P>Thank you. It is another one good solution. Works correctly. My awards for you</P> Sat, 12 Jan 2019 07:42:31 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403421#M116735 kvaga 2019-01-12T07:42:31Z https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403422#M116736 <P>You can only <CODE>Accept</CODE> one but you can <CODE>UpVote</CODE> all of them.</P> Sat, 12 Jan 2019 15:20:41 GMT https://community.splunk.com/t5/Splunk-Search/ID-of-the-max-value-event/m-p/403422#M116736 woodcock 2019-01-12T15:20:41Z