Splunk Search

How to get the time of the event when finding maximum event count that has happened in a minute over a time

RemyaT
Explorer

I have a query to find the maximum event count that has happened in a minute over time as below

index="xxx" "headers.a"="abc"  | rename "status.operation_path" as PATH | bucket _time span=1m | stats count by PATH  _time | stats max(count) by PATH 

The above query displays the maximum event count in a minute VS PATH.  I also need to display the time when this maximum event count happened for each path. 

Labels (4)
0 Karma

lshatzer
Path Finder

I adjusted your search to use the _internal index, you should be able to adjust the SPL to suit your use case.

This is where I would use eventstats to create a new field on each even that had the max value, and then filter to just those. And if you have two time buckets that have the same, grab just the latest.

 

index=_internal 
| bucket _time span=1m
| stats count by sourcetype _time
| eventstats max(count) as maxcount by sourcetype ```Get the max count for all buckets by sourcetype```
| where maxcount=count ```Filter down to where the maxcount is the count```
| stats latest(_time) AS _time, latest(count) by sourcetype ```Get just the latest time for that sourcetype, and the count```
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="xxx" "headers.a"="abc"  | rename "status.operation_path" as PATH | bucket _time span=1m | stats count by PATH  _time | eventstats max(count) as max by PATH | stats first(eval(if(count=max,_time,null()))) as _time max(max) as max by PATH
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...