https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283424#M85652 <P>The first three lines were cribbed from somesoni2's response. I usually use the synonym "bin" instead of "bucket".</P> Thu, 09 Feb 2017 17:37:51 GMT DalJeanis 2017-02-09T17:37:51Z https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283419#M85647 <P>I have a stats table of max hits by API for a given time period.</P> <PRE><CODE>index="ml_summary" report=api_stats earliest=-1w@w latest=now() | stats count as hit by date_minute, date_hour,date_mday,date_month,date_year, api| stats max(hit) as maxhit by api </CODE></PRE> <P>This returns multiple lines, showing each api name and the max hits for that api.</P> <P>How do I now reduce the results to a single line with the max hits from that set AND its associated api label?</P> Thu, 09 Feb 2017 15:47:30 GMT https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283419#M85647 feickertmd 2017-02-09T15:47:30Z https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283420#M85648 <P>Give this a try (slighly modified the initial part)</P> <PRE><CODE>index="ml_summary" report=api_stats earliest=-1w@w latest=now() | bucket span=1m _time | stats count as hit by _time api| stats max(hit) as maxhit by api | sort 1 maxhit </CODE></PRE> <P>If you want to keep the original, just add the <CODE>| sort 1 maxhit</CODE> at the end of your version.</P> Thu, 09 Feb 2017 16:15:06 GMT https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283420#M85648 somesoni2 2017-02-09T16:15:06Z https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283421#M85649 <P>Duh. I knew I was looking too deep and complex. Thanks!</P> Thu, 09 Feb 2017 16:41:10 GMT https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283421#M85649 feickertmd 2017-02-09T16:41:10Z https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283422#M85650 <P>Somesoni2's solution is good for what you asked. </P> <P>There is the possibility that you might have two or more of the same highest-hit minute, and you might also like to know WHEN you got the most hits on that , so you might consider something like this -</P> <PRE><CODE> index="ml_summary" report=api_stats earliest=-1w@w latest=now() | bucket span=1m _time | stats count as hit by _time api | eventstats max(hit) as overallmaxhit | where hit=overallmaxhit | table api hit _time | eval _time=strftime(_time,"%Y-%m-%d %H:%M) </CODE></PRE> Thu, 09 Feb 2017 16:56:39 GMT https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283422#M85650 DalJeanis 2017-02-09T16:56:39Z https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283423#M85651 <P>Ah, thank you. I forgot about bucket!</P> Thu, 09 Feb 2017 17:27:50 GMT https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283423#M85651 feickertmd 2017-02-09T17:27:50Z https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283424#M85652 <P>The first three lines were cribbed from somesoni2's response. I usually use the synonym "bin" instead of "bucket".</P> Thu, 09 Feb 2017 17:37:51 GMT https://community.splunk.com/t5/Splunk-Search/Grab-max-value-and-associated-value/m-p/283424#M85652 DalJeanis 2017-02-09T17:37:51Z