Splunk Search

How to find field with maximum value dynamically?

sivaranjani
Explorer

I have a data like this , and i want to display the step with maximum value.

Detail: { [-]
Id: 12345678
RequestCompleteTS: 2023-04-27T15:59:30.6960113-04:00
Steps: { [-]
0-step1: 32
0-step2: 15
3-step3: 33
4-step4: 49
5-step5: 15
6-step6: 9
7-step7: 8
}
StepsCnt: 18
TargetRegion: BRD
}
LogType: Info
Message: Success
Time: 2023-04-27 15:59:30.696--04:00

Desired Output

Id Step that is taking maximum time
12345678 4-step4
Labels (1)
0 Karma
1 Solution

sivaranjani
Explorer

Thank you very much. Exactly what i needed.

View solution in original post

0 Karma

sivaranjani
Explorer

Thank you very much. Exactly what i needed.

0 Karma

yeahnah
Motivator

Hi @sivaranjani 

Here's a run anywhere example showing a method...

| makeresults | eval _raw="{
	\"Detail\": {
		\"Id\": 12345678,
		\"RequestCompleteTS\": \"2023-04-27T15:59:30.6960113-04:00\",
		\"Steps\": {
			\"0-step1\": 32,
			\"0-step2\": 15,
			\"3-step3\": 33,
			\"4-step4\": 49,
			\"5-step5\": 15,
			\"6-step6\": 9,
			\"7-step7\": 8
		},
		\"StepsCnt\": 18,
		\"TargetRegion\": \"BRD\"
	},
	\"LogType\": \"Info\",
	\"Message\": \"Success\",
	\"Time\": \"2023-04-27 15:59:30.696--04:00\"
}" 
  ``` ^^^ create dummy event ^^^ ```
| spath
| rename Detail.Id AS Id Detail.Steps.* AS *
| foreach *step* [ eval Steps=if(isnull(Steps), '<<FIELD>>', mvappend(Steps, '<<FIELD>>')) ]
| eval steps_list_ordered=mvmap( mvsort(mvmap(mvdedup(Steps), len(Steps) . "-" . Steps)), substr(Steps, 3) )
      ,maxtime=mvindex(steps_list_ordered, mvcount(steps_list_ordered)-1)
| foreach *-step* [ eval "maxstep"=if('<<FIELD>>'=maxtime, "<<FIELD>>", if(isnotnull('maxstep'), 'maxstep', null())) ]
| rename maxstep AS "Step that is taking maximum time"
| table Id "Step that is taking maximum time" maxtime

Hope that helps.

Also, in the future please copy and paste the raw event data (syntax highlighting off) into the question using the Insert/Edit code sample button as this makes it far easier to try and help

yeahnah_0-1682640370372.png

 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...