Splunk Search

How do you compare several values to get the highest one?

sant1ago
New Member

Hello,

I want to compare several values to get the highest one. For example:

index   /      count
...............................
aaa           11716
bbb           30317
ccc            45
.
.
.    
zzz           1568

In this case the return for the query would be:

index   /      count
...............................
bbb           30317

Can someone help me please?

0 Karma
1 Solution

493669
Super Champion

Try this:

 | stats max(count) as count

OR

| eventstats max(count) as max|where count=max

View solution in original post

0 Karma

493669
Super Champion

Try this:

 | stats max(count) as count

OR

| eventstats max(count) as max|where count=max
0 Karma

sant1ago
New Member

thank you so much! It worked perfectly 😃

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...