How to produce a table visualization that spans time?

[sjlaplac]

The following SPL returns data for all returns for a day.

How can I just return the maximum return for the day?

Example:
July 1 data returns 12 apples, 10 oranges, and 5 cherries

I would only like to see 12 apples since its the highest count for that particular day.

July 2 returns 10 grapes, 7 kiwis, and 3 dates, only returns 10 grapes for that day

index=RazorApp sourcetype = TotalFruitsSold| | table CurrentDate, FruitsSold  

Any help would be greatly appreciated!

[adonio]

not sure how your data is structured exactly with FruitSold field, but lets assume its an integer, you will do something like this:
index=RazorApp sourcetype = TotalFruitsSold| | stats max(FruitsSold) as max_ammount by CurrentDate

show us a data sample and we can better assist
further reading:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Stats
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Top
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Rare
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/StatisticalFunctions

[maciep]

and if you need to know which fruit and not just the amount, you may need eventstats instead - get the max, then use it to find the winner.

... | eventstats max(FruitSold) as day_max by CurrentDate | where FruitSold=day_max | table CurrentDate, FruitName, FruitSold

and probably need to decide what you want to do when there's a tie.

[sjlaplac]

Awesome, this did the trick. Eventstats geez, of course. Thanks a million!