With a search like ....| eval Field3=Field1+Field3
I have data as follows(in the stats tab):
_time Field1 Field2 Field3
2015-05-11 00:00 915.426122 698.086667 217.33945530
2015-05-11 01:00 593.966923 462.311111 131.65581163
2015-05-11 02:00 403.424360 319.715556 83.708804253
2015-05-11 03:00 327.785973 261.006667 66.779305556
.
.
.
how do I get the max of each column?
I am thinking something like addcoltotalsbut that gets the sum of the columns but I want the max.
Hi HattrickNZ,
how about something like this:
.... | eval Field1=Field2+Field3 | stats max(Field1) AS Field1 max(Field2) AS Field2 max(Field3) AS Field3 by _time
It looks like you're adding up Field2 + Field3
so I changed it in above search.
Hope this helps ....
cheers, MuS
If you have may fields and do not know the name of them or variable number of fields, you can run it like this:
| stats max(*) as max_*
Hi HattrickNZ,
how about something like this:
.... | eval Field1=Field2+Field3 | stats max(Field1) AS Field1 max(Field2) AS Field2 max(Field3) AS Field3 by _time
It looks like you're adding up Field2 + Field3
so I changed it in above search.
Hope this helps ....
cheers, MuS
easy as that, tks.