Splunk Search

How to display message related to particular fields?

New Member

page="MIR" postid="2824567904373133_10151428930538134" message="Foot stools from MI..." time="2013-01-21" likes="188" comments="9" fromid="282904373133" picCount="1" videocount="0" linlcount="0" shares="0"

tried this query: sourcetype="..." |stats max(likes) as likes by page| table page,likes, message

My intention is to display a message with max likes but the above query does not work

Tags (2)
0 Karma


Use the following command to get a list which contains pages and max likes as columns :

.... | chart max(likes) AS Likes by page

Have a look at following Splunk Documentation :
link text

0 Karma