Splunk Search

How to count and compare the max amount of used different devices each day by groups for a week?

lemontree1
Explorer

Hello,
I try to count and compare the max amount of used different devices each day by groups for a week with the maximal available resources.
For each day I count a different amount of used devices per related group. For a week I want to determine the max. value for each group and compare this value with a predefined max available value.
With a a query like this:

<search> | timechart span=1d dc(devicename) by groupname                       <Last 7 days>

I get a table like this

_time             Group1      Group2    Group3 ...
7.1.2022       4                  8                 1
8.1.2022       2                  3                 0
9.1.2022       6                  2                 0
...

How I tried to calculate the max value of each column (Group) and compare it with a predefined value for the group?

With timecharts I didn't success.
timechart doesn't pass the the value through a next command?

Labels (2)
0 Karma

lemontree1
Explorer

Unfortunately the max field is empty, only the groupnames comes back

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d
| stats dc(devicename) as dc_devicename by _time groupname
| stats max(dc_devicename) as max_dc_devicename by groupname
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than timechart, use stats

| stats max(count) as max by group
0 Karma

lemontree1
Explorer
 
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...