https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134544#M36772 <P>The search should be</P> <P>my rex |sort 0 - ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName</P> <P>If your search returns more than 10,000 results then add | sort 0 field<BR /> sort command will truncate the output to 10000 rows. <BR /> results will be automatically limited to 10000 if you don't specify</P> <P>| sort 0 field</P> Wed, 09 Jul 2014 06:13:21 GMT th1agarajan 2014-07-09T06:13:21Z https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134541#M36769 <P>Log format</P> <P><STRONG>ServiceName,ResponseTime,RequestTime,TransactionId</STRONG><BR /> Service1,10,12,12345<BR /> Service2,5,8,12346<BR /> Service2,7,3,12347<BR /> Service1,8,25,12348<BR /> Service3,5,4,12349<BR /> Service2,10,2,12350</P> <P><B>Expected result</B></P> <TABLE border="1"> <TBODY><TR><TH>Service Name</TH><TH>Count</TH><TH>Max(ResponseTime)</TH><TH>RequestTime</TH><TH>TransactionId</TH></TR> <TR><TD>Service1</TD><TD>2</TD><TD>10</TD><TD>12</TD><TD>12345</TD></TR> <TR><TD>Service2</TD><TD>3</TD><TD>10</TD><TD>2</TD><TD>12350</TD></TR> <TR><TD>Service3</TD><TD>1</TD><TD>5</TD><TD>4</TD><TD>12349</TD></TR> </TBODY></TABLE> <P><BR /><BR /> I am able to get the service name,count and ResponseTime using the below search. But i need RequestTime and TransactionId based on Max(ResponseTIme). I need the RequestTime and TransactionId of the record which has Max(ResponseTime). Do i really need sub search to get the desired results?</P> <P>my rex | stats count,max(ResponseTime) by ServiceName</P> Wed, 09 Jul 2014 04:36:21 GMT https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134541#M36769 th1agarajan 2014-07-09T04:36:21Z https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134542#M36770 <P>Why do not you try to sort?</P> <P>my rex |sort ServiceName,- ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName</P> Wed, 09 Jul 2014 05:11:05 GMT https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134542#M36770 HiroshiSatoh 2014-07-09T05:11:05Z https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134543#M36771 <P>This is exactly i was looking for. Thank you very much HiroshiSatoh.</P> Wed, 09 Jul 2014 05:28:05 GMT https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134543#M36771 th1agarajan 2014-07-09T05:28:05Z https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134544#M36772 <P>The search should be</P> <P>my rex |sort 0 - ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName</P> <P>If your search returns more than 10,000 results then add | sort 0 field<BR /> sort command will truncate the output to 10000 rows. <BR /> results will be automatically limited to 10000 if you don't specify</P> <P>| sort 0 field</P> Wed, 09 Jul 2014 06:13:21 GMT https://community.splunk.com/t5/Splunk-Search/Search-result-based-on-max-field/m-p/134544#M36772 th1agarajan 2014-07-09T06:13:21Z