Dashboards & Visualizations

How to display the rows which has one single value more than 2

sangs8788
Communicator

Hi,

I have a query which displays the resultset as below,

alt text

I would like to get the Module which has gone more than 2s in any of the month. In the above screenshot, I need DocumentExchange to be resulted since it exceeded one of the month more than 2 s.

How do I achieve this? I tried to do | foreach *2020 [convert num(<<FIELD>>) as <<FIELD>> | search <<FIELD>>>2] But this results Module which were more than 2s in all the three months. How do i rewrite the query so that it lists Module which exceeds 2s even in any one of the month?

Please advise.
Thanks

using Max brings the max of fieldname and not the value

![alt text][2]

Labels (1)
Tags (1)
0 Karma
1 Solution

493669
Super Champion

@sangs8788, Try below for each command to get maximum value then compare it with 2.

...|  foreach *2020
   [ eval max = max('<<FIELD>>') ]|where max>2

View solution in original post

0 Karma

493669
Super Champion

@sangs8788, Try below for each command to get maximum value then compare it with 2.

...|  foreach *2020
   [ eval max = max('<<FIELD>>') ]|where max>2
0 Karma

sangs8788
Communicator

@493669

It is not providing the max value instead for all the rows it takes max of fields name and not field value.

0 Karma

493669
Super Champion

provide your sample data ,what is expected result and what it is returning using above query.

0 Karma

sangs8788
Communicator

I have updated my query with the screenshot. As you can see, Mar-2020 is taken as the max field

0 Karma

493669
Super Champion

Try this-

...| foreach *2020 
    [ eval Max=case(Max>='<<FIELD>>',Max,true(),'<<FIELD>>') ]
0 Karma

sangs8788
Communicator

ok you are doing a compare of the max with each and every field. Got it. This should ideally work.

0 Karma

sangs8788
Communicator

This Works. Thanks a lot

0 Karma

sangs8788
Communicator

That works. Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...