Splunk Search

How to count and compare the max amount of used different devices each day by groups for a week?

lemontree1
Explorer

Hello,
I try to count and compare the max amount of used different devices each day by groups for a week with the maximal available resources.
For each day I count a different amount of used devices per related group. For a week I want to determine the max. value for each group and compare this value with a predefined max available value.
With a a query like this:

<search> | timechart span=1d dc(devicename) by groupname                       <Last 7 days>

I get a table like this

_time             Group1      Group2    Group3 ...
7.1.2022       4                  8                 1
8.1.2022       2                  3                 0
9.1.2022       6                  2                 0
...

How I tried to calculate the max value of each column (Group) and compare it with a predefined value for the group?

With timecharts I didn't success.
timechart doesn't pass the the value through a next command?

Labels (2)
0 Karma

lemontree1
Explorer

Unfortunately the max field is empty, only the groupnames comes back

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d
| stats dc(devicename) as dc_devicename by _time groupname
| stats max(dc_devicename) as max_dc_devicename by groupname
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than timechart, use stats

| stats max(count) as max by group
0 Karma

lemontree1
Explorer
 
Tags (2)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...