Splunk Search

How to display the max value per day

faribole
Path Finder

My search calculate the number of events of a field per hour per day.
In my chart result I only want to see the max of each day

mysearch | timechart count span=1h as nb | eval Day=strftime(_time,"%Y/%m/%d") | dedup nb | top 1 nb by Day | sort + Day | table Day nb

The result is like that

Day nb
2019-08-26 300
2019-08-27 252
2019-08-28 354
2019-08-29 458

but i would like to see the time slot in my result, like that

Day nb
2019-08-26 10:00:00 300
2019-08-27 15:00:00 252
2019-08-28 13:00:00 354
2019-08-29 11:00:00 458

How to do that ?
Thanks

Tags (2)
0 Karma
1 Solution

DalJeanis
Legend

Try this -

mysearch 
| timechart span=1h  count as nb 
| eval Day=strftime(_time,"%Y/%m/%d") 
| eval Hour=strftime(_time,"%H:%M") 
| sort 0 Day - nb
| dedup Day 
| table Day Hour nb

View solution in original post

faribole
Path Finder

Thanks a lot. It's ok

0 Karma

DalJeanis
Legend

Try this -

mysearch 
| timechart span=1h  count as nb 
| eval Day=strftime(_time,"%Y/%m/%d") 
| eval Hour=strftime(_time,"%H:%M") 
| sort 0 Day - nb
| dedup Day 
| table Day Hour nb
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...