Each bucket of time, which event (or field) hit the max value?

[manus]

Let consider these events:

10:00:01 Player=player1, FragsPerHour=12

10:00:01 Player=player2, FragsPerHour=39

11:00:01 Player=player1, FragsPerHour=26

11:00:01 Player=player2, FragsPerHour=2

I would like a query which returns, in a table, which player made the most frags every hour, in this exemple:

10:00:00 player2

11:00:00 player1

I'm pretty sure bucket can be used for that, but don't see how:

| bucket _time span=1h|....

[manus · Accepted solution]

Here is a solution:
...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|table _time FragsPerHour Player

And, I'm not sure, but dedup is probably necessary in case two (or more) events hit the max among a same bucket:

...| bucket _time span=1h| eventstats max(FragsPerHour) as Maxx by _time | where FragsPerHour=Maxx| fields - Maxx|dedup _time|table _time FragsPerHour Player

[manus]

The key to this solution is the bucket function on time, followed by eventstats. Eventstats is no more than a stats function, with the result appended to each event.

As advised in the article below, I recommend Splunk beginners (like me) to read about eventstats and streamstats.

http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/

[manus]

Note that returning the max frag per hour is trivial:

|timechart span=1h max(FragsPerHour)