https://community.splunk.com/t5/Splunk-Search/Finding-max-of-a-count-up-to-each-hour-of-the-day/m-p/294573#M88899 <P>I think you want <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Streamstats">streamstats</A></P> <PRE><CODE> ... | streamstats max(Visitor_Count) as Max_So_Far </CODE></PRE> <P>just be sure to sort the results appropriately first if needed...</P> Tue, 04 Jul 2017 00:57:19 GMT maciep 2017-07-04T00:57:19Z https://community.splunk.com/t5/Splunk-Search/Finding-max-of-a-count-up-to-each-hour-of-the-day/m-p/294572#M88898 <P>I am wrestling with a query around getting a max value of a count per hour up to each. I will explain with an example...</P> <P>Hour 1 - 400 visitors<BR /> Hour 2 - 200 visitors<BR /> Hour 3 - 250 visitors<BR /> Hour 4 - 100 visitors<BR /> Hour 5 - 700 visitors<BR /> Hour 6 - 900 visitors</P> <P>I would like to calculate the max for each hour UP TO that hour. So for Hour 1, max would be 400. For Hour 2, the max will also be 400 since that is the max up to hour 2 (between 400 and 200). The max would be 400 for Hours 3 and 4 as well. Hour 5 would have a max of 700 visitors. Hour 6 would have a max of 900 visitors.</P> <P>The structure of data I'm working with is...<BR /> Hour Visitor_Count<BR /> 1 400<BR /> 2 200<BR /> ...</P> <P>I would like the max per hour up to each hour to be column 3.</P> <P>The one thing I've managed to do is calculate the max manually for each hour</P> <PRE><CODE>| eventstats sum(eval(if(hr&lt;=7,visitor_count,null()))) as max_for_hr_7 </CODE></PRE> <P>This works, but creates a column for each hour, and replicates the values for each column down all of the rows, so not ideal...<BR /> Hour Visitor_Count max_for_hr_1 max_for_hr_2 max_for_hr_3 ....</P> <P>Any thoughts on how I could achieve adding one additional column with the max of visitor count up to each hour?</P> <P>Thank you in advance!</P> Tue, 29 Sep 2020 14:45:29 GMT https://community.splunk.com/t5/Splunk-Search/Finding-max-of-a-count-up-to-each-hour-of-the-day/m-p/294572#M88898 bjmclean 2020-09-29T14:45:29Z https://community.splunk.com/t5/Splunk-Search/Finding-max-of-a-count-up-to-each-hour-of-the-day/m-p/294573#M88899 <P>I think you want <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Streamstats">streamstats</A></P> <PRE><CODE> ... | streamstats max(Visitor_Count) as Max_So_Far </CODE></PRE> <P>just be sure to sort the results appropriately first if needed...</P> Tue, 04 Jul 2017 00:57:19 GMT https://community.splunk.com/t5/Splunk-Search/Finding-max-of-a-count-up-to-each-hour-of-the-day/m-p/294573#M88899 maciep 2017-07-04T00:57:19Z https://community.splunk.com/t5/Splunk-Search/Finding-max-of-a-count-up-to-each-hour-of-the-day/m-p/294574#M88900 <P>Thank you @maciep! That worked perfectly!</P> Wed, 05 Jul 2017 13:05:07 GMT https://community.splunk.com/t5/Splunk-Search/Finding-max-of-a-count-up-to-each-hour-of-the-day/m-p/294574#M88900 bjmclean 2017-07-05T13:05:07Z