Splunk Search

Find the date on max value

jgan
New Member

I have a table below, how can I find the date I have the most income? Thanks.

date Income

9/18/2019 20.7651
9/17/2019 20.7656
9/16/2019 20.7539
9/13/2019 20.7661
9/12/2019 20.762
9/11/2019 20.7502
9/10/2019 20.7162
9/9/2019 20.7163
9/6/2019 20.716
9/5/2019 20.7055
9/4/2019 20.6596
9/3/2019 20.6115

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's one way, there may be others.

<your search> | streamstats window=0 max(income) as maxIncome | where income=maxIncome
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

jgan
New Member

streamstats did not work for me for some reasons, but eventstats works!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way, there may be others.

<your search> | streamstats window=0 max(income) as maxIncome | where income=maxIncome
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...