Splunk Search

Field value based on stats

rangarbus
Path Finder

I am new to splunk.  I have a need to get the visualization which shows the field of the corresponding stats value. 

Data looks like 

rangarbus_0-1599952745994.png

I want show.:

  • stat_date and min(Size),
  • stat_date and max(Size) 
  • stat_date and min(Files),
  • stat_date and max(Files)

Below query gets me the stats value, but i don't know how to get the corresponding stat_date for each of this.

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| stats min(Size) as min_size max(Size) as max_size min(Files) as min_file max(Files) as max_file

 

rangarbus_1-1599953022267.png

Thank you

Labels (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@rangarbus 

check updated answer.

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

thank you @thambisetty  ! It worked exactly like what i was looking for..  Appreciate your help!

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

Thank you @thambisetty  .

My need here is to get the corresponding stat_date for min and max value on the data.. Sorry if I wasn't clear on initial question.

Here in this case, min_size corresponds to stat_date as 09/05/2020 and max_size corresponds to stat_date as 09/06/2020

min_sizemin_size_datemax_sizemax_size_date
5.0209/05/202052.2809/06/2020
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...