https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307827#M92339 <P>Hi exmuzzy,<BR /> let me understand: do you want max in a column and min in another one?<BR /> if this is your requirement delete the transpose command!</P> <PRE><CODE> index=_internal | timechart span=1h count by host | stats max(*) AS *."max", min(*) as *."min" </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sun, 15 Oct 2017 08:19:40 GMT gcusello 2017-10-15T08:19:40Z https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307826#M92338 <P>If I use such SPL</P> <PRE><CODE>index=_internal | timechart span=1h count by host | stats max(*) AS *."max", min(*) as *."min" | transpose </CODE></PRE> <P>this produce min and max mixed in one column but I would like separate max and min column</P> Sun, 15 Oct 2017 07:06:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307826#M92338 exmuzzy 2017-10-15T07:06:27Z https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307827#M92339 <P>Hi exmuzzy,<BR /> let me understand: do you want max in a column and min in another one?<BR /> if this is your requirement delete the transpose command!</P> <PRE><CODE> index=_internal | timechart span=1h count by host | stats max(*) AS *."max", min(*) as *."min" </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sun, 15 Oct 2017 08:19:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307827#M92339 gcusello 2017-10-15T08:19:40Z https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307828#M92340 <P>Can you please give a view of how you want the result and min and max of what ? </P> Sun, 15 Oct 2017 08:20:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307828#M92340 kunalmao 2017-10-15T08:20:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307829#M92341 <P>Hi exmuzzy,<BR /> I have</P> <PRE><CODE>giuseppe-pc.max giuseppe-pc.min 102494 0 </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Sun, 15 Oct 2017 08:23:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307829#M92341 gcusello 2017-10-15T08:23:38Z https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307830#M92342 <P>No, I would like to rich such result</P> <PRE><CODE> max min </CODE></PRE> <P>giuseppe-pc 0 334<BR /> backeтd 12 502</P> Mon, 16 Oct 2017 06:50:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307830#M92342 exmuzzy 2017-10-16T06:50:53Z https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307831#M92343 <P>Hi exmuzzy,<BR /> did you tried?</P> <PRE><CODE>index=_internal | bin_time span=1h | chart max(count) AS Max min(count) as Min BY host </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Mon, 16 Oct 2017 11:04:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-min-and-max-per-hour-during-day-by-host/m-p/307831#M92343 gcusello 2017-10-16T11:04:05Z