topic max after stats, chart in Splunk Search

max after stats, chart

jrodriguezap — Tue, 17 Sep 2013 15:28:33 GMT

Hi, I have a result that comes from: search ... | stats count by MB

MB   count
3.1   4
2.8   2
3.6   1
2.3   5
3.5   1

I would get the count value has more:

MB   count
2.3   5

With that it would be possible?
I appreciate your help.
Greetings.

sowings — Tue, 17 Sep 2013 15:31:20 GMT

In this case, I would set up a new field with eventstats (it leaves the original set alone), and then search for where they're equal:

YOUR_SEARCH_HERE | stats count by MB | eventstats max(count) AS max | where count=max

jrodriguezap — Tue, 17 Sep 2013 17:10:38 GMT

Thank you. I was of help, I had to add the same for the MB column, because when he heard the count for several MB, leaving several.

...| stats count by MB | eventstats max(count) AS maxCount | where count=maxCount | eventstats max(MB) AS maxMB| where MB=maxMB | fields MB