topic query for top value in Splunk Search

query for top value

DTERM — Mon, 20 Aug 2012 20:18:35 GMT

Let's say you have a log that looks like....

X -- Y -- Z

=== === ===

AAA BBB 123

AAA BBB 356

YYY ZZZ 800

AAA BBB 900

YYY ZZZ 345

What query would allow me to extract the highest number Z where X and Y are equal.

So for the example above, I would expect to see results like:

AAA BBB 900

YYY ZZZ 800

Thanks.

Re: query for top value

Ayn — Mon, 20 Aug 2012 20:36:09 GMT

Explain how X and Y are equal in the lines you're expecting to see? Also, do you mean that the actual log event looks like this in a kind of tabular format?

Re: query for top value

kristian_kolb — Mon, 20 Aug 2012 20:51:17 GMT

Well, depending on the nature of X and Y, there are a couple of options, one of them being a simple string concatenation for the comparison:

... | eval Q = X." ".Y | stats max(Z) AS Z by Q | rename Q AS "X and Y"

which would give you a table like;

X and Y          Z
AAA BBB          900
CCC DDD          800

Hope this helps,

Krisitan

Re: query for top value

DTERM — Tue, 21 Aug 2012 14:58:20 GMT

Perfect. Thanks so much!! But can you explain the "eval Q = X." ".Y" portion of that. I don't quite get that...

Re: query for top value

kristian_kolb — Tue, 21 Aug 2012 16:22:31 GMT

The dot (.) is the concatenation operator; so the eval statement creates the 'AAA BBB' and 'CCC DDD' strings, which appear under the 'X and Y' heading.

Of course, this could have been illustrated better with proper log events.

The reason for doing so is that you'll need to find the highest value for the combination of A and Y.

Re: query for top value

DTERM — Wed, 22 Aug 2012 13:43:10 GMT

Thanks much!!