Splunk Search

Each bucket of time, which event (or field) hit the max value?

manus
Communicator

Let consider these events:

10:00:01 Player=player1, FragsPerHour=12

10:00:01 Player=player2, FragsPerHour=39

11:00:01 Player=player1, FragsPerHour=26

11:00:01 Player=player2, FragsPerHour=2

I would like a query which returns, in a table, which player made the most frags every hour, in this exemple:

10:00:00 player2

11:00:00 player1

I'm pretty sure bucket can be used for that, but don't see how:

| bucket _time span=1h|....

Tags (4)
0 Karma
1 Solution

manus
Communicator

Here is a solution:
...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|table _time FragsPerHour Player

And, I'm not sure, but dedup is probably necessary in case two (or more) events hit the max among a same bucket:

...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|dedup _time|table _time FragsPerHour Player

View solution in original post

0 Karma

manus
Communicator

Here is a solution:
...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|table _time FragsPerHour Player

And, I'm not sure, but dedup is probably necessary in case two (or more) events hit the max among a same bucket:

...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|dedup _time|table _time FragsPerHour Player

0 Karma

manus
Communicator

The key to this solution is the bucket function on time, followed by eventstats. Eventstats is no more than a stats function, with the result appended to each event.

As advised in the article below, I recommend Splunk beginners (like me) to read about eventstats and streamstats.

http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/

0 Karma

manus
Communicator

Note that returning the max frag per hour is trivial:

|timechart span=1h max(FragsPerHour)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...