Splunk Search

Field value based on stats

rangarbus
Path Finder

I am new to splunk.  I have a need to get the visualization which shows the field of the corresponding stats value. 

Data looks like 

rangarbus_0-1599952745994.png

I want show.:

  • stat_date and min(Size),
  • stat_date and max(Size) 
  • stat_date and min(Files),
  • stat_date and max(Files)

Below query gets me the stats value, but i don't know how to get the corresponding stat_date for each of this.

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| stats min(Size) as min_size max(Size) as max_size min(Files) as min_file max(Files) as max_file

 

rangarbus_1-1599953022267.png

Thank you

Labels (3)
0 Karma
1 Solution

thambisetty
Super Champion

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
Super Champion

@rangarbus 

check updated answer.

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

thank you @thambisetty  ! It worked exactly like what i was looking for..  Appreciate your help!

0 Karma

thambisetty
Super Champion

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

rangarbus
Path Finder

Thank you @thambisetty  .

My need here is to get the corresponding stat_date for min and max value on the data.. Sorry if I wasn't clear on initial question.

Here in this case, min_size corresponds to stat_date as 09/05/2020 and max_size corresponds to stat_date as 09/06/2020

min_sizemin_size_datemax_sizemax_size_date
5.0209/05/202052.2809/06/2020
0 Karma