Dashboards & Visualizations

How to display timstamp of max util value?

priya1926
Path Finder

hi,

i am using this query to display max value by a host for Disk Read Time. 

Also i need the max values TIMESTAMP. This search can be for 24 hrs or a week or a month.. but the timestamp should be exact of the entry to the max value time..

index=perfmon source="Perfmon:LogicalDisk" host="abc" object=LogicalDisk | search NOT(instance=_Total) counter="% Disk Read Time" | eval Idx=instance | stats max(Value) by Idx, host

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command discards all fields except Idx, host, and "max(Value)" so there is no _time to display.  Also, the max function does not associate the result with the event from which it came (there may be multiple events with the same max value).

Try this.

index=perfmon source="Perfmon:LogicalDisk" host="abc" object=LogicalDisk 
| search NOT(instance=_Total) counter="% Disk Read Time" 
| eval Idx=instance 
```Find the highest value for each Idx/host pair and make it a new field```
| eventstats max(Value) as MaxValue by Idx, host
```Keep only the events with the highest MaxValue field```
| where Value = MaxValue
| table _time, Idx, host, MaxValue
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...