Splunk Search

Getting the Date for the max() value

modulussplunk
Loves-to-Learn

Howdy I have a search like this:

modulussplunk_0-1641668543314.png

Everything is great!

 

Would it be possible to add a column that contains the timestamp for max(seconds) ?

I've googled and even tried out some solutions I found here but can't quite get it...

(i.e If I try to add "by host, _time" I get ALL the results). 

Thanks!

 

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats max(seconds) as max median(seconds) as median ... by host
| where seconds=max
0 Karma

modulussplunk
Loves-to-Learn

Thanks so much. But it no longer shows any stats..

Do you want eventstats to replace stats entirely or pipe the whole previous search into eventstats as you list it below?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Eventstats replaces the stats - the ... means put the other stats in here too - that is, just replace stats with eventstats and then pipe to the where command

0 Karma

modulussplunk
Loves-to-Learn

Ah. I see. Thanks very much. I added table to the query and it appears all is well. Many thanks here!

 

My Final Query:

modulussplunk_0-1641754833770.png

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...