Splunk Search

How to get unique Maximum value of corresponding field?

ISP8055
Path Finder

Hi there, 

I have data like this:

Server load
A65
A50
B35
C55
B45
C70

 

I want to get a maximum peak loads of each server type and display in a table format.
So,

ServerPeak load
A65
B

45

C

70


I need help in how can I do that?

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ISP8055 

Can you please try this?

YOUR_SEARCH
| stats max(load) as load by Server

 

My Sample Search :

| makeresults 
| eval _raw="Server	load
A	65
A	50
B	35
C	55
B	45
C	70" 
| multikv forceheader=1
| table Server 	load
| stats max(load) as load by Server


 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ISP8055 

Can you please try this?

YOUR_SEARCH
| stats max(load) as load by Server

 

My Sample Search :

| makeresults 
| eval _raw="Server	load
A	65
A	50
B	35
C	55
B	45
C	70" 
| multikv forceheader=1
| table Server 	load
| stats max(load) as load by Server


 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...