Splunk Search

Field value based on stats

rangarbus
Path Finder

I am new to splunk.  I have a need to get the visualization which shows the field of the corresponding stats value. 

Data looks like 

rangarbus_0-1599952745994.png

I want show.:

  • stat_date and min(Size),
  • stat_date and max(Size) 
  • stat_date and min(Files),
  • stat_date and max(Files)

Below query gets me the stats value, but i don't know how to get the corresponding stat_date for each of this.

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| stats min(Size) as min_size max(Size) as max_size min(Files) as min_file max(Files) as max_file

 

rangarbus_1-1599953022267.png

Thank you

Labels (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@rangarbus 

check updated answer.

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

thank you @thambisetty  ! It worked exactly like what i was looking for..  Appreciate your help!

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

Thank you @thambisetty  .

My need here is to get the corresponding stat_date for min and max value on the data.. Sorry if I wasn't clear on initial question.

Here in this case, min_size corresponds to stat_date as 09/05/2020 and max_size corresponds to stat_date as 09/06/2020

min_sizemin_size_datemax_sizemax_size_date
5.0209/05/202052.2809/06/2020
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...