https://community.splunk.com/t5/Splunk-Search/find-maximum-value-of-a-field-by-host-over-the-last-7-days/m-p/428895#M122675 <P>Try the below query, you can do transpose if needed</P> <PRE><CODE>index=perfmon sourcetype="Perfmon:" host=A OR host=B OR host=C OR host=D object="Processor" counter="% Processor Time" instance="" | eval date= strftime(_time,"%Y-%m-%d") | sort - 0 date host Value | dedup date host | table _time Value host </CODE></PRE> Thu, 18 Oct 2018 04:31:51 GMT Vijeta 2018-10-18T04:31:51Z https://community.splunk.com/t5/Splunk-Search/find-maximum-value-of-a-field-by-host-over-the-last-7-days/m-p/428894#M122674 <P>I need am trying to find the maximum value of a field(Peak value and time at which it happened everyday) based on a other field for the last seven days, I am using the time chart to get the values of the field but I need the exact time of the filed when it occurred rather than only the day. Can someone help me with this?</P> <P>Need the know what is the Peak Processing time of hosts and the time when that is occurring. </P> <P>index=<EM>perfmon</EM> sourcetype="Perfmon:<EM>" host=A OR host=B OR host=C OR host=D object="Processor" counter="% Processor Time" instance="</EM>" <BR /> | timechart span=1d max(Value) as Peak by host </P> <P>which gives results as,</P> <P>_time A B C D<BR /> 2018-10-10 45 67 6 56<BR /> 2018-10-11 12 45 56 45<BR /> 2018-10-12 79 78 34 67</P> Wed, 17 Oct 2018 21:48:09 GMT https://community.splunk.com/t5/Splunk-Search/find-maximum-value-of-a-field-by-host-over-the-last-7-days/m-p/428894#M122674 arrangineni 2018-10-17T21:48:09Z https://community.splunk.com/t5/Splunk-Search/find-maximum-value-of-a-field-by-host-over-the-last-7-days/m-p/428895#M122675 <P>Try the below query, you can do transpose if needed</P> <PRE><CODE>index=perfmon sourcetype="Perfmon:" host=A OR host=B OR host=C OR host=D object="Processor" counter="% Processor Time" instance="" | eval date= strftime(_time,"%Y-%m-%d") | sort - 0 date host Value | dedup date host | table _time Value host </CODE></PRE> Thu, 18 Oct 2018 04:31:51 GMT https://community.splunk.com/t5/Splunk-Search/find-maximum-value-of-a-field-by-host-over-the-last-7-days/m-p/428895#M122675 Vijeta 2018-10-18T04:31:51Z