https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29026#M5805 <PRE><CODE>&lt;your search&gt; | stats max(err) min(err) by host,fpc,ichip </CODE></PRE> <P>edit:</P> <PRE><CODE>* | stats max(err) as max_err min(err) as min_err by host,fpc,ichip | eval rate=(max_err-min_err)/720 | fields - max_err min_err | sort -rate </CODE></PRE> Fri, 13 Aug 2010 01:02:55 GMT ziegfried 2010-08-13T01:02:55Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29025#M5804 <PRE><CODE>* | rex "(?&lt;fpc&gt;fpc\d+) (?&lt;ichip&gt;ICHIP\(\d+\)):Packet drop in Ichip pktwr,rate: %\S+: \d+, total: (?&lt;err&gt;\d+)" </CODE></PRE> <P>How do I get the max(err) and min(err) for each combination of host, fpc, ichip ?</P> <P>err is an integer number.</P> Fri, 13 Aug 2010 00:03:47 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29025#M5804 vadud3 2010-08-13T00:03:47Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29026#M5805 <PRE><CODE>&lt;your search&gt; | stats max(err) min(err) by host,fpc,ichip </CODE></PRE> <P>edit:</P> <PRE><CODE>* | stats max(err) as max_err min(err) as min_err by host,fpc,ichip | eval rate=(max_err-min_err)/720 | fields - max_err min_err | sort -rate </CODE></PRE> Fri, 13 Aug 2010 01:02:55 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29026#M5805 ziegfried 2010-08-13T01:02:55Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29027#M5806 <P>how do I sort it by host with highest rate ? rate is (max(err) - min(err)) / 720</P> Fri, 13 Aug 2010 03:51:51 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29027#M5806 vadud3 2010-08-13T03:51:51Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29028#M5807 <P>added to the answer</P> Fri, 13 Aug 2010 03:53:55 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-max-and-min-for-a-combination-of-multiple-fields/m-p/29028#M5807 ziegfried 2010-08-13T03:53:55Z