topic How to return a group by value with the highest number of items? in Splunk Search

How to return a group by value with the highest number of items?

jbrenner — Wed, 21 Feb 2018 18:47:57 GMT

How do I modify the following query to return the name of the FRUIT with the highest count:

index="myindex" URI="myuri" | stats count by FRUIT

Thanks,
Jonathan

493669 — Wed, 21 Feb 2018 18:55:15 GMT

Try this:

index="myindex" URI="myuri" | stats count by FRUIT|stats max(count) as max

jbrenner — Wed, 21 Feb 2018 19:00:19 GMT

That gives me the count, but I want to return the name of the fruit.

Thanks,
Jonathan

493669 — Wed, 21 Feb 2018 19:26:43 GMT

ok then try this it will give max count with name of fruit:

index="myindex" URI="myuri" | stats count by FRUIT|stats max(count) as max by FRUIT|head 1

somesoni2 — Wed, 21 Feb 2018 19:33:34 GMT

You can do like this

index="myindex" URI="myuri" | top 1 FRUIT

This will give you name of top 1 FRUIT based on event count. You can adjust the number in top command to return more

jbrenner — Wed, 21 Feb 2018 19:45:19 GMT

Hi somesoni2,

That is perfect, thanks!

Now how could I modify your query to return the fruit name concatenated to the count in a single string like so:

 apple:2013

Thanks,
Jonathan

somesoni2 — Wed, 21 Feb 2018 20:13:52 GMT

A simple eval statement will do that

above search | eval FRUIT=FRUIT.":".count