topic Re: Using &quot;stats max(foo)&quot;, is it possible to get the whole line of the log that contains the max value of foo? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Using-quot-stats-max-foo-quot-is-it-possible-to-get-the-whole/m-p/257800#M77208 <P>Try like this</P> <PRE><CODE>... | eventstats max(foo) as maxfoo | where foo=maxfoo | table _raw foo </CODE></PRE> Mon, 17 Oct 2016 18:19:38 GMT sundareshr 2016-10-17T18:19:38Z Using "stats max(foo)", is it possible to get the whole line of the log that contains the max value of foo? https://community.splunk.com/t5/Splunk-Search/Using-quot-stats-max-foo-quot-is-it-possible-to-get-the-whole/m-p/257799#M77207 <P>When I use <CODE>| stats max(foo)</CODE> I get the largest value of foo.</P> <P>Is it possible to get the whole line of the log which contain this largest value?</P> Mon, 17 Oct 2016 18:10:42 GMT https://community.splunk.com/t5/Splunk-Search/Using-quot-stats-max-foo-quot-is-it-possible-to-get-the-whole/m-p/257799#M77207 viggor 2016-10-17T18:10:42Z Re: Using "stats max(foo)", is it possible to get the whole line of the log that contains the max value of foo? https://community.splunk.com/t5/Splunk-Search/Using-quot-stats-max-foo-quot-is-it-possible-to-get-the-whole/m-p/257800#M77208 <P>Try like this</P> <PRE><CODE>... | eventstats max(foo) as maxfoo | where foo=maxfoo | table _raw foo </CODE></PRE> Mon, 17 Oct 2016 18:19:38 GMT https://community.splunk.com/t5/Splunk-Search/Using-quot-stats-max-foo-quot-is-it-possible-to-get-the-whole/m-p/257800#M77208 sundareshr 2016-10-17T18:19:38Z