Getting Data In

Display only rows that contain the max value

obrienk
Explorer

I am attempting to use a pivot grid to display items in a grid that contain the max value of a column

Example:

UsersOrdersVersionNumber
121
243
354
435
565

I only want to display the rows that contain the max VersionNumber.
When doing something like this through the search command, I would use eventstats to store the max value and then test each row against that.

Example:
| eventstats max(VersionNumber) as Big | where VersionNumber = Big

I would have thought that the filter in the pivot table would have enabled me to do this but I have not been able to see a solution. Can anyone help?

Thanks

Tags (3)

obrienk
Explorer

As an update to this question, I resolved the issue by moving away from the pivot table and using the eventstats in each query to limit the results to the max VersionNumber. This is now working.

obrienk
Explorer

Just to add, would it be possible to do this in the constraint when setting up the data model?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...