Splunk Search

How to get stats max count of a field by another field?

bijodev1
Communicator

Hi There, I am looking to produce an output where the field with maximum count is display based on another field.

for, eg I am looking something command like 

| stats max(count(errors) by status

time                                       status             errors                    count

2022-03-02 05:30 100 not found 100
2022-03-02 05:30 200 success 300
2022-03-02 05:30 300 failed 500
2022-03-02 06:30 100 not found 400
2022-03-02 06:30 200 success 500
2022-03-02 06:30 300 failed 600
2022-03-02 07:30 100 not found 200
2022-03-02 07:30 200 success 700
2022-03-02 07:30 300 failed 200

 

What I am looking for is the max count each status and error

time                                       status           errors                    count

2022-03-02 05:30 100 not found 400
2022-03-02 06:30 200 success 700
2022-03-02 07:30 300 failed 600

 

I tried many thing but with no luck, if someone could help with this.

Labels (3)
Tags (1)
0 Karma
1 Solution

bijodev1
Communicator

thank you everyone.

Took me sometime , But this one worked for me

my search 
| stats count by _time status errors
| sort -count
| dedup _time status
| sort _time

View solution in original post

0 Karma

bijodev1
Communicator

thank you everyone.

Took me sometime , But this one worked for me

my search 
| stats count by _time status errors
| sort -count
| dedup _time status
| sort _time

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like there is a one-to-one relationship between status and errors, so would this work?

| stats max(count) as count values(errors) as errors max(time) as time by status
0 Karma

somesoni2
Revered Legend

Try something like this

Your base search which gives fields _time status errors count
| eventstats max(count) as max by status errors
| where count=max | fields -max
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...