Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to get a max point in a given range
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Splunkians (?).
I have a table of data with 2 fields : host / data_used_mb / _timestamp
host data_used_mb _timestamp
H01 59 12:00
H01 78 13:00
...
H02 15 12:00
H02 20 13:00
...
H06 993 12:00
...
If I were to calculate the MAX of the last 24 hours data points (24 points) for EACH host by rolling them up,
How could I implement this? I looked into "tail" command, but it doesn't take it "by host", or "stats latest(data_used_mb)" which gives only the last point.
Any help from you gus would be highly appreciated!
Jack
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
... | bucket _time span=1d | stats max(data_used_mb) by _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried simply setting your time range picker to "Last 24 hours"?
If that doesn't work, look into fixing your timestamp extraction.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! Try this: ... earliest=-30d| bucket _time span=1h| stats max(data_used_mb) by host _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
... | bucket _time span=1d | stats max(data_used_mb) by _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay, but what if I'm ONLY interested in the max of Last 24 points out of say 30 days of hourly data?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
earliest=-30d | stats list(data_used_mb) AS data_used_mb by host | mvexpand data_used_mb limit=24 | stats max(data_used_mb) by host
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
