Getting the Date for the max() value

[modulussplunk]

Howdy I have a search like this:

modulussplunk_0-1641668543314.png

Everything is great!

Would it be possible to add a column that contains the timestamp for max(seconds) ?

I've googled and even tried out some solutions I found here but can't quite get it...

(i.e If I try to add "by host, _time" I get ALL the results). 

Thanks!

[ITWhisperer]

| eventstats max(seconds) as max median(seconds) as median ... by host
| where seconds=max

[modulussplunk]

Thanks so much. But it no longer shows any stats..

Do you want eventstats to replace stats entirely or pipe the whole previous search into eventstats as you list it below?

[ITWhisperer]

Eventstats replaces the stats - the ... means put the other stats in here too - that is, just replace stats with eventstats and then pipe to the where command

[modulussplunk]

Ah. I see. Thanks very much. I added table to the query and it appears all is well. Many thanks here!

My Final Query:

modulussplunk_0-1641754833770.png