Splunk Search

How to get the field name of the maximum value of several fields?

brajaram
Communicator

I have data that has several fields. I want to compare the fields to find the max value of them, which I can do via
| eval maximum=max(field1, field2, field3)

However, I also want to return the field name of the value that is the highest. Is there a simple function that does this?

Tags (2)
0 Karma
1 Solution

masonmorales
Influencer

It would be helpful to have some context on what your end goal is, but what you're describing is possible by just doing something like this:

index=_internal source=*metrics* | fieldsummary | sort - max | head 1 | fields field max

or

index=_internal source=*metrics* | fieldsummary | stats max(max) as max by field | sort - max

View solution in original post

0 Karma

masonmorales
Influencer

It would be helpful to have some context on what your end goal is, but what you're describing is possible by just doing something like this:

index=_internal source=*metrics* | fieldsummary | sort - max | head 1 | fields field max

or

index=_internal source=*metrics* | fieldsummary | stats max(max) as max by field | sort - max
0 Karma

sunilsk1
Path Finder

After sorting . pipe the result to "|head 1" to display just the one row you are interested in.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...