Splunk Search

Field value based on stats

rangarbus
Path Finder

I am new to splunk.  I have a need to get the visualization which shows the field of the corresponding stats value. 

Data looks like 

rangarbus_0-1599952745994.png

I want show.:

  • stat_date and min(Size),
  • stat_date and max(Size) 
  • stat_date and min(Files),
  • stat_date and max(Files)

Below query gets me the stats value, but i don't know how to get the corresponding stat_date for each of this.

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| stats min(Size) as min_size max(Size) as max_size min(Files) as min_file max(Files) as max_file

 

rangarbus_1-1599953022267.png

Thank you

Labels (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@rangarbus 

check updated answer.

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

thank you @thambisetty  ! It worked exactly like what i was looking for..  Appreciate your help!

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

Thank you @thambisetty  .

My need here is to get the corresponding stat_date for min and max value on the data.. Sorry if I wasn't clear on initial question.

Here in this case, min_size corresponds to stat_date as 09/05/2020 and max_size corresponds to stat_date as 09/06/2020

min_sizemin_size_datemax_sizemax_size_date
5.0209/05/202052.2809/06/2020
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...