Splunk Search

How do you compare several values to get the highest one?

sant1ago
New Member

Hello,

I want to compare several values to get the highest one. For example:

index   /      count
...............................
aaa           11716
bbb           30317
ccc            45
.
.
.    
zzz           1568

In this case the return for the query would be:

index   /      count
...............................
bbb           30317

Can someone help me please?

0 Karma
1 Solution

493669
Super Champion

Try this:

 | stats max(count) as count

OR

| eventstats max(count) as max|where count=max

View solution in original post

0 Karma

493669
Super Champion

Try this:

 | stats max(count) as count

OR

| eventstats max(count) as max|where count=max
0 Karma

sant1ago
New Member

thank you so much! It worked perfectly 😃

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...