https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587493#M204599 Thu, 03 Mar 2022 17:06:42 GMT lemontree1 2022-03-03T17:06:42Z https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587418#M204573 <P>Hello,<BR />I try to count and compare the max amount of used different devices each day by groups for a week with the maximal available resources.<BR />For each day I count a different amount of used devices per related group. For a week I want to determine the max. value for each group and compare this value with a predefined max available value.<BR />With a a query like this:</P> <P>&lt;search&gt; | timechart span=1d dc(devicename) by groupname&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Last 7 days&gt;</P> <P>I get a table like this</P> <P>_time&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Group2&nbsp;&nbsp;&nbsp; Group3 ...<BR />7.1.2022 &nbsp; &nbsp; &nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1<BR />8.1.2022 &nbsp; &nbsp; &nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0<BR />9.1.2022&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0<BR />...</P> <P>How I tried to calculate the max value of each column (Group) and compare it with a predefined value for the group?</P> <P>With timecharts I didn't success.<BR />timechart doesn't pass the the value through a next command?</P> Thu, 03 Mar 2022 17:32:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587418#M204573 lemontree1 2022-03-03T17:32:22Z https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587420#M204574 <P>Rather than timechart, use stats</P><LI-CODE lang="markup">| stats max(count) as max by group</LI-CODE> Thu, 03 Mar 2022 12:18:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587420#M204574 ITWhisperer 2022-03-03T12:18:37Z https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587493#M204599 Thu, 03 Mar 2022 17:06:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587493#M204599 lemontree1 2022-03-03T17:06:42Z https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587496#M204601 <P>Unfortunately the max field is empty, only the groupnames comes back</P> Thu, 03 Mar 2022 17:08:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587496#M204601 lemontree1 2022-03-03T17:08:14Z https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587504#M204604 <LI-CODE lang="markup">| bin _time span=1d | stats dc(devicename) as dc_devicename by _time groupname | stats max(dc_devicename) as max_dc_devicename by groupname</LI-CODE> Thu, 03 Mar 2022 17:46:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-and-compare-the-max-amount-of-used-different/m-p/587504#M204604 ITWhisperer 2022-03-03T17:46:40Z