Splunk Search

How to get max value from each columns that are created dynamicly based on time range

maniu1609
Path Finder

search query | timechart span=1m count by A1

the above query gives me below output:

_time column1 column2 column3

2018-05-25 10:20:05 1 1 0

2018-05-25 10:09:39 4 0 0

2018-05-25 10:27:16 0 2 2

2018-05-25 10:22:06 1 1 1

2018-05-25 10:12:45 1 1 2

2018-05-25 10:25:07 1 1 3

No of columns depends on the time range we choose(i.e) sometimes 3 columns and sometimes 6 columns and so on..
So if the above is my scenario, how I can find max values from each column and their _time value.

My expected output is:

_time column1 column2 column3

2018-05-25 10:09:39 4 0 0

2018-05-25 10:27:16 0 2 2

2018-05-25 10:25:07 1 1 3

so out main aim here is, how we can find max value of columns created dynamically.

Please help me out. I'm struggling with my task.

Tags (2)
0 Karma
1 Solution

niketn
Legend

@maniu1609, try the following search:

<yourBaseSearch>
|  bin _time span=1m
|  stats count by _time A1
|  eventstats max(count) as Maximum by A1
|  where count=Maximum

PS: It will list multiple time for A1 if maximum count for specific A1 remains the same in multiple time buckets.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this

search query | timechart span=1m count by A1
| eventstats max(*) as max*
| eval keep="N" 
| foreach max* [| eval keep=if('<<FIELD>>'='<<MATCHSTR>>',"Y",keep) ]
| where keep="Y" | fields - max* keep

maniu1609
Path Finder

it also works for me!!. Thanks!!

0 Karma

niketn
Legend

@maniu1609, try the following search:

<yourBaseSearch>
|  bin _time span=1m
|  stats count by _time A1
|  eventstats max(count) as Maximum by A1
|  where count=Maximum

PS: It will list multiple time for A1 if maximum count for specific A1 remains the same in multiple time buckets.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

maniu1609
Path Finder

It works great!!. Thanks!!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...