How to get stats max count of a field by another field?

[bijodev1]

Hi There, I am looking to produce an output where the field with maximum count is display based on another field.

for, eg I am looking something command like 

| stats max(count(errors) by status

time                                       status             errors                    count

2022-03-02 05:30	100	not found	100
2022-03-02 05:30	200	success	300
2022-03-02 05:30	300	failed	500
2022-03-02 06:30	100	not found	400
2022-03-02 06:30	200	success	500
2022-03-02 06:30	300	failed	600
2022-03-02 07:30	100	not found	200
2022-03-02 07:30	200	success	700
2022-03-02 07:30	300	failed	200

What I am looking for is the max count each status and error

time                                       status           errors                    count

2022-03-02 05:30	100	not found	400
2022-03-02 06:30	200	success	700
2022-03-02 07:30	300	failed	600

I tried many thing but with no luck, if someone could help with this.

[bijodev1 · Accepted solution]

thank you everyone.

Took me sometime , But this one worked for me

my search 
| stats count by _time status errors
| sort -count
| dedup _time status
| sort _time

[ITWhisperer]

It looks like there is a one-to-one relationship between status and errors, so would this work?

| stats max(count) as count values(errors) as errors max(time) as time by status

[somesoni2]

Try something like this

Your base search which gives fields _time status errors count
| eventstats max(count) as max by status errors
| where count=max | fields -max