How do I found max value of rex field?

[user9025]

I have a splunk event as follow:

request-id=123  STOP method TYPE=ABC, ID=[678] --- TIME_TAKEN=1281ms

I have lot of events like this and I want to find the max time taken.

I have query as :

****QUERY**** || rex field=_raw "TIME_TAKEN=(?<TIME_TAKEN>\d+)ms" | table TIME_TAKEN

Now I am able to get all Time value in table. But I dont want them in table but I just want the max entry out of this.How can i replace last operation so that I can max value from TIME_TAKEN in output.I dont need anything else

[ITWhisperer · Accepted solution]

| stats max(TIME_TAKEN)