Splunk Search

How to add a column with the max values for a set of fields on each row and add these values in the totals row?

David_Hodgson
Engager

I need to add a maximum column for a set of fields on each row (created using chart ... OVER ... BY ... ), and then add the maximum of this into the totals row. Any suggestions on how to do this?

0 Karma

sundareshr
Legend

Don't believe addtotals has that option, but here is a workaround you could try

eventtype=splunkd-log earliest=@h | chart count over component by eventtype | untable component eventtype count | appendpipe [stats max(count) as max by component ] | sort component | eval c=coalesce(count, max) | fillnull value="Max" eventtype | chart list(c) as c over component by eventtype
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...