Hi There, I am looking to produce an output where the field with maximum count is display based on another field.
for, eg I am looking something command like
| stats max(count(errors) by status
time status errors count
2022-03-02 05:30 | 100 | not found | 100 |
2022-03-02 05:30 | 200 | success | 300 |
2022-03-02 05:30 | 300 | failed | 500 |
2022-03-02 06:30 | 100 | not found | 400 |
2022-03-02 06:30 | 200 | success | 500 |
2022-03-02 06:30 | 300 | failed | 600 |
2022-03-02 07:30 | 100 | not found | 200 |
2022-03-02 07:30 | 200 | success | 700 |
2022-03-02 07:30 | 300 | failed | 200 |
What I am looking for is the max count each status and error
time status errors count
2022-03-02 05:30 | 100 | not found | 400 |
2022-03-02 06:30 | 200 | success | 700 |
2022-03-02 07:30 | 300 | failed | 600 |
I tried many thing but with no luck, if someone could help with this.
thank you everyone.
Took me sometime , But this one worked for me
my search
| stats count by _time status errors
| sort -count
| dedup _time status
| sort _time
thank you everyone.
Took me sometime , But this one worked for me
my search
| stats count by _time status errors
| sort -count
| dedup _time status
| sort _time
It looks like there is a one-to-one relationship between status and errors, so would this work?
| stats max(count) as count values(errors) as errors max(time) as time by status
Try something like this
Your base search which gives fields _time status errors count
| eventstats max(count) as max by status errors
| where count=max | fields -max