topic Re: Find the date on max value in Splunk Search

Find the date on max value

jgan — Fri, 20 Sep 2019 13:09:25 GMT

I have a table below, how can I find the date I have the most income? Thanks.

date Income

9/18/2019 20.7651
9/17/2019 20.7656
9/16/2019 20.7539
9/13/2019 20.7661
9/12/2019 20.762
9/11/2019 20.7502
9/10/2019 20.7162
9/9/2019 20.7163
9/6/2019 20.716
9/5/2019 20.7055
9/4/2019 20.6596
9/3/2019 20.6115

Re: Find the date on max value

richgalloway — Fri, 20 Sep 2019 14:24:08 GMT

Here's one way, there may be others.

<your search> | streamstats window=0 max(income) as maxIncome | where income=maxIncome

Re: Find the date on max value

jgan — Sun, 22 Sep 2019 19:56:45 GMT

streamstats did not work for me for some reasons, but eventstats works!