Splunk Search

How to get stats max count of a field by another field?

bijodev1
Communicator

Hi There, I am looking to produce an output where the field with maximum count is display based on another field.

for, eg I am looking something command like 

| stats max(count(errors) by status

time                                       status             errors                    count

2022-03-02 05:30 100 not found 100
2022-03-02 05:30 200 success 300
2022-03-02 05:30 300 failed 500
2022-03-02 06:30 100 not found 400
2022-03-02 06:30 200 success 500
2022-03-02 06:30 300 failed 600
2022-03-02 07:30 100 not found 200
2022-03-02 07:30 200 success 700
2022-03-02 07:30 300 failed 200

 

What I am looking for is the max count each status and error

time                                       status           errors                    count

2022-03-02 05:30 100 not found 400
2022-03-02 06:30 200 success 700
2022-03-02 07:30 300 failed 600

 

I tried many thing but with no luck, if someone could help with this.

Labels (3)
Tags (1)
0 Karma
1 Solution

bijodev1
Communicator

thank you everyone.

Took me sometime , But this one worked for me

my search 
| stats count by _time status errors
| sort -count
| dedup _time status
| sort _time

View solution in original post

0 Karma

bijodev1
Communicator

thank you everyone.

Took me sometime , But this one worked for me

my search 
| stats count by _time status errors
| sort -count
| dedup _time status
| sort _time

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like there is a one-to-one relationship between status and errors, so would this work?

| stats max(count) as count values(errors) as errors max(time) as time by status
0 Karma

somesoni2
Revered Legend

Try something like this

Your base search which gives fields _time status errors count
| eventstats max(count) as max by status errors
| where count=max | fields -max
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...