topic Re: Getting the Date for the max() value in Splunk Search

Getting the Date for the max() value

modulussplunk — Sat, 08 Jan 2022 19:06:08 GMT

Howdy I have a search like this:

Everything is great!

Would it be possible to add a column that contains the timestamp for max(seconds) ?

I've googled and even tried out some solutions I found here but can't quite get it...

(i.e If I try to add "by host, _time" I get ALL the results).

Thanks!

Re: Getting the Date for the max() value

ITWhisperer — Sat, 08 Jan 2022 22:42:14 GMT

| eventstats max(seconds) as max median(seconds) as median ... by host | where seconds=max

Re: Getting the Date for the max() value

modulussplunk — Sun, 09 Jan 2022 00:11:15 GMT

Thanks so much. But it no longer shows any stats..

Do you want eventstats to replace stats entirely or pipe the whole previous search into eventstats as you list it below?

Re: Getting the Date for the max() value

ITWhisperer — Sun, 09 Jan 2022 09:57:58 GMT

Eventstats replaces the stats - the ... means put the other stats in here too - that is, just replace stats with eventstats and then pipe to the where command

Re: Getting the Date for the max() value

modulussplunk — Sun, 09 Jan 2022 19:00:40 GMT

Ah. I see. Thanks very much. I added table to the query and it appears all is well. Many thanks here!

My Final Query: