Splunk Search

Displaying largest value from Multiple Extractions in each Event

Path Finder

Hi all,

I have multiple events where in each individual event, I'm extracting multiple fields using regex. Essentially it looks like this where each BU is a separate field I'm extracting from the event:

BU1 - 84.5xx.x
BU2- 83.5xx.x
BU3- 83.6xx.x
BU4- 85.xxx.x

I want to compare all extracted fields from each individual event and display only the the highest number as another field lets say largest_BU. Is there any way to do this?
Thank you in advance.

0 Karma
1 Solution

Esteemed Legend

Yes, like this:

...| eval largest_BU=0 | foreach BU* [ eval largest_BU=max(largest_BU, <<FIELD>>) ]

View solution in original post

Esteemed Legend

Yes, like this:

...| eval largest_BU=0 | foreach BU* [ eval largest_BU=max(largest_BU, <<FIELD>>) ]

View solution in original post

Path Finder

Thank you, and as a side note it also worked when i set my rex to search for that specific pattern with a max_match=0, then i just use eval max

0 Karma