topic Re: Create a table with max and sum values in Splunk Search

How to create a table with max and sum values

HelloItsMe76 — Thu, 14 Jul 2022 16:08:55 GMT

I have a table like the below

Category | Time | Count of string

A | t-5mins | 18

A | t-10mins | 7

A | t-15mins | 10

A | t-20 mins | 1

B | t-5mins | 6

B | t-10 mins | 18

I would like to create a table with the latest (max) time and the sum of the count by category so that i get this

Category | Max Time | Sum

A | t-5mins | 36

B | T-5mins | 24

I can get the max time and the sum individually into a table but am having issues getting them both into 1 table - the time and sum values are coming up blank.

Can someone advise please?

Re: Create a table with max and sum values

ITWhisperer — Thu, 14 Jul 2022 15:37:16 GMT

Have you tried something like this?

| stats max(time) as maxTime sum(count) as sum by Category

Re: Create a table with max and sum values

HelloItsMe76 — Thu, 14 Jul 2022 15:46:00 GMT

Hey, thanks for the response. yes i have and it returns the correct data for the 2 fields but it doesnt pass in the Category field which i need. How can i get all 3 fields?

Re: Create a table with max and sum values

HelloItsMe76 — Thu, 14 Jul 2022 15:47:54 GMT

actually it did work. i had been using 'by Category' on both fields. thanks for the help!