Splunk Search

How to display message related to particular fields?

manohart31
New Member

page="MIR" postid="2824567904373133_10151428930538134" message="Foot stools from MI..." time="2013-01-21" likes="188" comments="9" fromid="282904373133" picCount="1" videocount="0" linlcount="0" shares="0"

tried this query: sourcetype="..." |stats max(likes) as likes by page| table page,likes, message

My intention is to display a message with max likes but the above query does not work

Tags (2)
0 Karma

ranjyotiprakash
Communicator

Use the following command to get a list which contains pages and max likes as columns :

.... | chart max(likes) AS Likes by page

Have a look at following Splunk Documentation :
link text

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...