Splunk Search

How to count and compare the max amount of used different devices each day by groups for a week?

lemontree1
Explorer

Hello,
I try to count and compare the max amount of used different devices each day by groups for a week with the maximal available resources.
For each day I count a different amount of used devices per related group. For a week I want to determine the max. value for each group and compare this value with a predefined max available value.
With a a query like this:

<search> | timechart span=1d dc(devicename) by groupname                       <Last 7 days>

I get a table like this

_time             Group1      Group2    Group3 ...
7.1.2022       4                  8                 1
8.1.2022       2                  3                 0
9.1.2022       6                  2                 0
...

How I tried to calculate the max value of each column (Group) and compare it with a predefined value for the group?

With timecharts I didn't success.
timechart doesn't pass the the value through a next command?

Labels (2)
0 Karma

lemontree1
Explorer

Unfortunately the max field is empty, only the groupnames comes back

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d
| stats dc(devicename) as dc_devicename by _time groupname
| stats max(dc_devicename) as max_dc_devicename by groupname
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than timechart, use stats

| stats max(count) as max by group
0 Karma

lemontree1
Explorer
 
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...