https://community.splunk.com/t5/Splunk-Search/How-to-get-the-time-of-the-event-when-finding-maximum-event/m-p/651383#M225199 <LI-CODE lang="markup">index="xxx" "headers.a"="abc" | rename "status.operation_path" as PATH | bucket _time span=1m | stats count by PATH _time | eventstats max(count) as max by PATH | stats first(eval(if(count=max,_time,null()))) as _time max(max) as max by PATH</LI-CODE> Thu, 20 Jul 2023 22:08:42 GMT ITWhisperer 2023-07-20T22:08:42Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-time-of-the-event-when-finding-maximum-event/m-p/651381#M225198 <P>I have a query to find the&nbsp;maximum event count that has happened in a minute over time as below</P><LI-CODE lang="markup">index="xxx" "headers.a"="abc" | rename "status.operation_path" as PATH | bucket _time span=1m | stats count by PATH _time | stats max(count) by PATH </LI-CODE><P>The above query displays the maximum event count in a minute VS PATH.&nbsp; I also need to display the time when this maximum event count happened for each path.&nbsp;</P> Thu, 20 Jul 2023 21:12:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-time-of-the-event-when-finding-maximum-event/m-p/651381#M225198 RemyaT 2023-07-20T21:12:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-time-of-the-event-when-finding-maximum-event/m-p/651383#M225199 <LI-CODE lang="markup">index="xxx" "headers.a"="abc" | rename "status.operation_path" as PATH | bucket _time span=1m | stats count by PATH _time | eventstats max(count) as max by PATH | stats first(eval(if(count=max,_time,null()))) as _time max(max) as max by PATH</LI-CODE> Thu, 20 Jul 2023 22:08:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-time-of-the-event-when-finding-maximum-event/m-p/651383#M225199 ITWhisperer 2023-07-20T22:08:42Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-time-of-the-event-when-finding-maximum-event/m-p/651384#M225200 <P>I adjusted your search to use the _internal index, you should be able to adjust the SPL to suit your use case.</P><P>This is where I would use eventstats to create a new field on each even that had the max value, and then filter to just those. And if you have two time buckets that have the same, grab just the latest.</P><P>&nbsp;</P><PRE>index=_internal <BR />| bucket _time span=1m <BR />| stats count by sourcetype _time <BR />| eventstats max(count) as maxcount by sourcetype ```Get the max count for all buckets by sourcetype```<BR />| where maxcount=count ```Filter down to where the maxcount is the count```<BR />| stats latest(_time) AS _time, latest(count) by sourcetype ```Get just the latest time for that sourcetype, and the count```</PRE> Thu, 20 Jul 2023 22:13:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-time-of-the-event-when-finding-maximum-event/m-p/651384#M225200 lshatzer 2023-07-20T22:13:10Z