Solved: Find the date on max value

jgan · ‎09-20-2019

I have a table below, how can I find the date I have the most income? Thanks.

date Income

9/18/2019 20.7651
9/17/2019 20.7656
9/16/2019 20.7539
9/13/2019 20.7661
9/12/2019 20.762
9/11/2019 20.7502
9/10/2019 20.7162
9/9/2019 20.7163
9/6/2019 20.716
9/5/2019 20.7055
9/4/2019 20.6596
9/3/2019 20.6115

richgalloway · ‎09-20-2019

Here's one way, there may be others.

<your search> | streamstats window=0 max(income) as maxIncome | where income=maxIncome

---
If this reply helps you, Karma would be appreciated.

View solution in original post

jgan · ‎09-22-2019

streamstats did not work for me for some reasons, but eventstats works!

richgalloway · ‎09-20-2019

Here's one way, there may be others.

<your search> | streamstats window=0 max(income) as maxIncome | where income=maxIncome

---
If this reply helps you, Karma would be appreciated.

Find the date on max value

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Build and Launch AI Agents from Your Splunk Workflows

index This | What kind of room has no doors?

Join the Conversation