topic Re: Searching Max values in a span/range in Splunk Search

Searching Max values in a span/range

jlkokko — Thu, 31 Jul 2014 20:11:36 GMT

I'm not sure of the proper approach for this query. I have a list of events,one event per day, with fields min,max and base. Starting with any date I need to pull the base for that date as well as the highest Max in a range span of 3 or 4 events [Note: I say events because because the log has missing dates].

as an Example snippet:

Date,Min,Max,Base

2014-07-23,8.66,8.79,8.59

2014-07-22,8.68,8.74,8.58

2014-07-21,8.59,8.69,8.49

2014-07-18,8.59,8.73,8.45

I would need to return the date, its base and the highest Max in the range:

Date, Base, Max
2014-07-18, 8.45, 8.68

For creating the ranges, should I should use a span or a bin with a foreach or is there a more appropriate method?

Re: Searching Max values in a span/range

somesoni2 — Thu, 31 Jul 2014 20:39:04 GMT

You want to group fix no of EVENTS together and get the Base and Max value for the lowest date?? (base on the sample output that you provided)

Re: Searching Max values in a span/range

jlkokko — Thu, 31 Jul 2014 21:14:27 GMT

No - I want to group a number of Events together and get the Base of the first event in the group and the get the highest Max for the group.

Re: Searching Max values in a span/range

somesoni2 — Thu, 31 Jul 2014 21:27:00 GMT

Try something like this (assuming the fields are already extracted by same name.

your base search | streamstats count | eval count=floor((count-1)/4) | stats first(Date) as Date first(Base) as Base max(Max) as Max by count

where '4' is the bin size.

Re: Searching Max values in a span/range

martin_mueller — Fri, 01 Aug 2014 23:14:12 GMT

Not sure if I understand your requirements correctly... here's what I think you want:

grab the event for the specified date
grab the next (for example) 3 events that happened after that - might be the next three days, might have gaps
return the original event's date and base value as well as the maximum max value over all four events

Since there's no way or knowing how far in the future you need to look to get the next three events you could do something like this run over a timerange from the specified date to now:

your base search | tail 4 | stats earliest(Date) as Date earliest(Base) as Base max(Max) as Max

If your specified date is far into the past and there's a lot of data since then this would churn through all of the data and discard most of them - so if possible you can specify a latest time closer to the specified date but far away enough to be sure there will be another three events in there.