Splunk Search

Field value based on stats

rangarbus
Path Finder

I am new to splunk.  I have a need to get the visualization which shows the field of the corresponding stats value. 

Data looks like 

rangarbus_0-1599952745994.png

I want show.:

  • stat_date and min(Size),
  • stat_date and max(Size) 
  • stat_date and min(Files),
  • stat_date and max(Files)

Below query gets me the stats value, but i don't know how to get the corresponding stat_date for each of this.

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| stats min(Size) as min_size max(Size) as max_size min(Files) as min_file max(Files) as max_file

 

rangarbus_1-1599953022267.png

Thank you

Labels (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

@rangarbus 

check updated answer.

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

thank you @thambisetty  ! It worked exactly like what i was looking for..  Appreciate your help!

0 Karma

thambisetty
SplunkTrust
SplunkTrust

 

 

| stats sum(mbFileSize) AS "Size", dc(FileName) AS "Files" by stat_date
| eventstats min(Size) as min_size max(Size) as max_size
| eval min=case(min_size=Size,Size),max=case(max_size=Size,Size),min_size_date=case(min_size=Size,stat_date),max_size_date=case(max_size=Size,stat_date)
| fields min,min_size_date,max,max_size_date
| stats values(*) as *
| rename min as min_size, max as max_size
| table min_size min_size_date max_size max_size_date

 

 

————————————
If this helps, give a like below.
0 Karma

rangarbus
Path Finder

Thank you @thambisetty  .

My need here is to get the corresponding stat_date for min and max value on the data.. Sorry if I wasn't clear on initial question.

Here in this case, min_size corresponds to stat_date as 09/05/2020 and max_size corresponds to stat_date as 09/06/2020

min_sizemin_size_datemax_sizemax_size_date
5.0209/05/202052.2809/06/2020
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...