Hello,
I want to compare several values to get the highest one. For example:
index / count
...............................
aaa 11716
bbb 30317
ccc 45
.
.
.
zzz 1568
In this case the return for the query would be:
index / count
...............................
bbb 30317
Can someone help me please?
Try this:
| stats max(count) as count
OR
| eventstats max(count) as max|where count=max
Try this:
| stats max(count) as count
OR
| eventstats max(count) as max|where count=max
thank you so much! It worked perfectly 😃