Splunk Search

How to find the field value corresponding to an extremity (min, max)?


Say I have sales figures

  Month   Sales
  June      44
  July      55
  August    66
  September 60
  November  50

How do I know that August is the month when sales maximized? This seems to be a common operation, but I can't find an easy function to call.

All I can come up with is a convoluted manipulation, like

| eventstats max(Sales) as maxSales
| eval maxMonth=if(Sales==maxSales,Month,null)
| stats max(maxSales) values(maxMonth)

(It is OK if two field values match.)

As this is just a small part of a more complex operation, it feels awkward to do all these just to find peak value of an associated field.

0 Karma

Esteemed Legend

The easiest way is:

... | sort - Sales | head 1

But you probably need all the events so try:

... | eventstats max(Sales) as maxSales

And then maybe after that:

... | where Sales=maxSales | table Month


... | eval MaxSalesMonth = if((Sales==maxSales), "Yes", "No")
0 Karma


Yes, I am looking to keep all events, so head and where do not apply. the last one is the same as the one I posted in the question, which I feel convoluted, as the number of events involved are numerous. I need the associated value(s) only as a quick reference in a complex scheduled search that already uses lots of stats manipulations.

Of course, if there is no better way, I'll have to take what I get.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!