Splunk Search

Find the date on max value

jgan
New Member

I have a table below, how can I find the date I have the most income? Thanks.

date Income

9/18/2019 20.7651
9/17/2019 20.7656
9/16/2019 20.7539
9/13/2019 20.7661
9/12/2019 20.762
9/11/2019 20.7502
9/10/2019 20.7162
9/9/2019 20.7163
9/6/2019 20.716
9/5/2019 20.7055
9/4/2019 20.6596
9/3/2019 20.6115

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's one way, there may be others.

<your search> | streamstats window=0 max(income) as maxIncome | where income=maxIncome
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

jgan
New Member

streamstats did not work for me for some reasons, but eventstats works!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way, there may be others.

<your search> | streamstats window=0 max(income) as maxIncome | where income=maxIncome
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...