<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Finding the minimum and maximum value in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Finding-the-minimum-and-maximum-value/m-p/293503#M88606</link>
    <description>&lt;P&gt;Hi All,&lt;/P&gt;

&lt;P&gt;I have 3 files in one index, &lt;STRONG&gt;&lt;EM&gt;Cycle 10.csv, Cycle 11.csv&lt;/EM&gt;&lt;/STRONG&gt;, and &lt;STRONG&gt;&lt;EM&gt;Cycle 12.csv&lt;/EM&gt;&lt;/STRONG&gt;. &lt;/P&gt;

&lt;P&gt;All of the 3 files have a "Cycle Number" fields with values:&lt;BR /&gt;
     &lt;STRONG&gt;&lt;EM&gt;10 for Cycle 10.csv&lt;BR /&gt;&lt;BR /&gt;
     11 for Cycle 11.csv &lt;BR /&gt;
     12 for Cycle 12.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;The &lt;STRONG&gt;&lt;EM&gt;Cycle Number&lt;/EM&gt;&lt;/STRONG&gt; field is just an indicator for each cycle to be able to identify the previous and the current cycle.&lt;/P&gt;

&lt;P&gt;What I want to do is, first, to search the top 2 values of the &lt;STRONG&gt;&lt;EM&gt;Cycle Number&lt;/EM&gt;&lt;/STRONG&gt; field. &lt;BR /&gt;
So, I am expecting that it would return only the &lt;STRONG&gt;&lt;EM&gt;Cycle 11.csv&lt;/EM&gt;&lt;/STRONG&gt; and &lt;STRONG&gt;&lt;EM&gt;Cycle 12.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;BR /&gt;
Then, I would like to have a separate search for the &lt;STRONG&gt;&lt;EM&gt;Cycle Number&lt;/EM&gt;&lt;/STRONG&gt; with minimum value(Cycle 11.csv) and maximum values(Cycle 12.csv)&lt;/P&gt;

&lt;P&gt;How would I be able to do this?&lt;/P&gt;

&lt;P&gt;Thanks in advance and best regards. &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Wed, 14 Feb 2018 07:36:28 GMT</pubDate>
    <dc:creator>jvmerilla</dc:creator>
    <dc:date>2018-02-14T07:36:28Z</dc:date>
    <item>
      <title>Finding the minimum and maximum value</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Finding-the-minimum-and-maximum-value/m-p/293503#M88606</link>
      <description>&lt;P&gt;Hi All,&lt;/P&gt;

&lt;P&gt;I have 3 files in one index, &lt;STRONG&gt;&lt;EM&gt;Cycle 10.csv, Cycle 11.csv&lt;/EM&gt;&lt;/STRONG&gt;, and &lt;STRONG&gt;&lt;EM&gt;Cycle 12.csv&lt;/EM&gt;&lt;/STRONG&gt;. &lt;/P&gt;

&lt;P&gt;All of the 3 files have a "Cycle Number" fields with values:&lt;BR /&gt;
     &lt;STRONG&gt;&lt;EM&gt;10 for Cycle 10.csv&lt;BR /&gt;&lt;BR /&gt;
     11 for Cycle 11.csv &lt;BR /&gt;
     12 for Cycle 12.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;The &lt;STRONG&gt;&lt;EM&gt;Cycle Number&lt;/EM&gt;&lt;/STRONG&gt; field is just an indicator for each cycle to be able to identify the previous and the current cycle.&lt;/P&gt;

&lt;P&gt;What I want to do is, first, to search the top 2 values of the &lt;STRONG&gt;&lt;EM&gt;Cycle Number&lt;/EM&gt;&lt;/STRONG&gt; field. &lt;BR /&gt;
So, I am expecting that it would return only the &lt;STRONG&gt;&lt;EM&gt;Cycle 11.csv&lt;/EM&gt;&lt;/STRONG&gt; and &lt;STRONG&gt;&lt;EM&gt;Cycle 12.csv&lt;/EM&gt;&lt;/STRONG&gt;&lt;BR /&gt;
Then, I would like to have a separate search for the &lt;STRONG&gt;&lt;EM&gt;Cycle Number&lt;/EM&gt;&lt;/STRONG&gt; with minimum value(Cycle 11.csv) and maximum values(Cycle 12.csv)&lt;/P&gt;

&lt;P&gt;How would I be able to do this?&lt;/P&gt;

&lt;P&gt;Thanks in advance and best regards. &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 14 Feb 2018 07:36:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Finding-the-minimum-and-maximum-value/m-p/293503#M88606</guid>
      <dc:creator>jvmerilla</dc:creator>
      <dc:date>2018-02-14T07:36:28Z</dc:date>
    </item>
    <item>
      <title>Re: Finding the minimum and maximum value</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Finding-the-minimum-and-maximum-value/m-p/293504#M88607</link>
      <description>&lt;P&gt;|inputlookups 10.csv  | append [11.csv] | append [12.csv] | sort - | head 2&lt;/P&gt;</description>
      <pubDate>Fri, 09 Mar 2018 11:15:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Finding-the-minimum-and-maximum-value/m-p/293504#M88607</guid>
      <dc:creator>valiquet</dc:creator>
      <dc:date>2018-03-09T11:15:55Z</dc:date>
    </item>
  </channel>
</rss>

