Splunk Search

How to get max value from each columns that are created dynamicly based on time range

maniu1609
Path Finder

search query | timechart span=1m count by A1

the above query gives me below output:

_time column1 column2 column3

2018-05-25 10:20:05 1 1 0

2018-05-25 10:09:39 4 0 0

2018-05-25 10:27:16 0 2 2

2018-05-25 10:22:06 1 1 1

2018-05-25 10:12:45 1 1 2

2018-05-25 10:25:07 1 1 3

No of columns depends on the time range we choose(i.e) sometimes 3 columns and sometimes 6 columns and so on..
So if the above is my scenario, how I can find max values from each column and their _time value.

My expected output is:

_time column1 column2 column3

2018-05-25 10:09:39 4 0 0

2018-05-25 10:27:16 0 2 2

2018-05-25 10:25:07 1 1 3

so out main aim here is, how we can find max value of columns created dynamically.

Please help me out. I'm struggling with my task.

Tags (2)
0 Karma
1 Solution

niketnilay
Legend

@maniu1609, try the following search:

<yourBaseSearch>
|  bin _time span=1m
|  stats count by _time A1
|  eventstats max(count) as Maximum by A1
|  where count=Maximum

PS: It will list multiple time for A1 if maximum count for specific A1 remains the same in multiple time buckets.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

somesoni2
Revered Legend

Try something like this

search query | timechart span=1m count by A1
| eventstats max(*) as max*
| eval keep="N" 
| foreach max* [| eval keep=if('<<FIELD>>'='<<MATCHSTR>>',"Y",keep) ]
| where keep="Y" | fields - max* keep

maniu1609
Path Finder

it also works for me!!. Thanks!!

0 Karma

niketnilay
Legend

@maniu1609, try the following search:

<yourBaseSearch>
|  bin _time span=1m
|  stats count by _time A1
|  eventstats max(count) as Maximum by A1
|  where count=Maximum

PS: It will list multiple time for A1 if maximum count for specific A1 remains the same in multiple time buckets.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

maniu1609
Path Finder

It works great!!. Thanks!!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!