Displaying largest value from Multiple Extractions in each Event

[raby1996]

Hi all,

I have multiple events where in each individual event, I'm extracting multiple fields using regex. Essentially it looks like this where each BU is a separate field I'm extracting from the event:

BU1 - 84.5xx.x
BU2- 83.5xx.x
BU3- 83.6xx.x
BU4- 85.xxx.x

I want to compare all extracted fields from each individual event and display only the the highest number as another field lets say largest_BU. Is there any way to do this?
Thank you in advance.

[woodcock · Accepted solution]

Yes, like this:

...| eval largest_BU=0 | foreach BU* [ eval largest_BU=max(largest_BU, <<FIELD>>) ]

[raby1996]

Thank you, and as a side note it also worked when i set my rex to search for that specific pattern with a max_match=0, then i just use eval max