Splunk Search

Get values of several series during same timespan that the maximum of one series during a day

gregory_cordier
Explorer

Hi,

I built a report that list daily maximums and averages of counts per hour on several days. (difficult to put it in phrase..)
Here is the query I use:

<search string>
| bucket _time span=1h 
| stats dc(Serial) as dcSerial, dc(otherserial) as dcOtherSerial by _time 
| bucket _time span=1d 
| eval Processedtime=strptime(_time,"%s") 
| stats max(dcSerial) avg(dcSerial) max(dcOtherSerial) avg(dcOtherSerial) by Processedtime

So this query returns maximums of distinct counts of each fields, which is good.
But what I need is to return the dcOtherSerial has when dcSerial is at the maximum during the day (because I don't care about the maximum of dcOtherSerial, I want to correlate both of them).
Is it understandable ?

any thoughts?

thanks

Tags (2)
0 Karma

to4kawa
Ultra Champion
 <search string>
 | bucket _time span=1h 
 | stats dc(Serial) as dcSerial, dc(otherserial) as dcOtherSerial by _time 
 | bucket _time span=1d 
 | eval Processedtime=strptime(_time,"%s") 
 | eventstats max(dcSerial) avg(dcSerial) max(dcOtherSerial) avg(dcOtherSerial) by Processedtime
 | where as_you_like

use eventstats not stats

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...