Let consider these events:
10:00:01 Player=player1, FragsPerHour=12
10:00:01 Player=player2, FragsPerHour=39
11:00:01 Player=player1, FragsPerHour=26
11:00:01 Player=player2, FragsPerHour=2
I would like a query which returns, in a table, which player made the most frags every hour, in this exemple:
10:00:00 player2
11:00:00 player1
I'm pretty sure bucket can be used for that, but don't see how:
| bucket _time span=1h|....
Here is a solution:
...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|table _time FragsPerHour Player
And, I'm not sure, but dedup is probably necessary in case two (or more) events hit the max among a same bucket:
...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|dedup _time|table _time FragsPerHour Player
Here is a solution:
...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|table _time FragsPerHour Player
And, I'm not sure, but dedup is probably necessary in case two (or more) events hit the max among a same bucket:
...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|dedup _time|table _time FragsPerHour Player
The key to this solution is the bucket function on time, followed by eventstats. Eventstats is no more than a stats function, with the result appended to each event.
As advised in the article below, I recommend Splunk beginners (like me) to read about eventstats and streamstats.
http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/
Note that returning the max frag per hour is trivial:
|timechart span=1h max(FragsPerHour)