https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283972#M85824 <P>How to find out the event with max duration?<BR /> I used command transaction to group events and I want to find out the event with max duration.</P> Fri, 28 Oct 2016 02:23:55 GMT chhawu 2016-10-28T02:23:55Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283972#M85824 <P>How to find out the event with max duration?<BR /> I used command transaction to group events and I want to find out the event with max duration.</P> Fri, 28 Oct 2016 02:23:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283972#M85824 chhawu 2016-10-28T02:23:55Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283973#M85825 <P>Details are unknown, but ...<BR /> ・・・・|transaction ・・・・|stats max(duration)<BR /> OR<BR /> ・・・・|transaction ・・・・|sort -duration|head 1</P> Fri, 28 Oct 2016 06:35:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283973#M85825 HiroshiSatoh 2016-10-28T06:35:11Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283974#M85826 <P>You are right ! I try to search with second search script to get the longest transaction,but is there any way to show column one "max(duration)" and column two _raw at once? </P> Fri, 28 Oct 2016 14:42:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283974#M85826 chhawu 2016-10-28T14:42:29Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283975#M85827 <P>Instead of doing the <CODE>... | head 1</CODE>, try instead using the <CODE>limit=&lt;number&gt;</CODE> parameter of the sort. Then to make it pretty or include other fields, use the <CODE>table</CODE> command.</P> <PRE><CODE>... | transaction ...stuff... |table duration, _raw | sort limit=1 - duration </CODE></PRE> <P>Give that a shot and see if it works for you.</P> <P>Happy Splunking!<BR /> Rich</P> Fri, 28 Oct 2016 15:32:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283975#M85827 Richfez 2016-10-28T15:32:09Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283976#M85828 <P>Hi Rich</P> <P>Thanks ! I am going to modify my search script base on your suggestion.</P> Tue, 01 Nov 2016 02:48:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283976#M85828 chhawu 2016-11-01T02:48:40Z https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283977#M85829 <P>Selected answer correct for if you have one field name, for multiple similarly I use:</P> <PRE><CODE>|sort - duration |dedup field_name </CODE></PRE> Thu, 08 Mar 2018 18:25:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-out-the-event-with-max-duration/m-p/283977#M85829 akocak 2018-03-08T18:25:45Z