Splunk Search

How to return a group by value with the highest number of items?

jbrenner
Path Finder

How do I modify the following query to return the name of the FRUIT with the highest count:

index="myindex" URI="myuri" | stats count by FRUIT

Thanks,
Jonathan

Tags (2)
0 Karma
1 Solution

493669
Super Champion

Try this:

index="myindex" URI="myuri" | stats count by FRUIT|stats max(count) as max

View solution in original post

0 Karma

somesoni2
Revered Legend

You can do like this

index="myindex" URI="myuri" | top 1 FRUIT

This will give you name of top 1 FRUIT based on event count. You can adjust the number in top command to return more

0 Karma

jbrenner
Path Finder

Hi somesoni2,

That is perfect, thanks!

Now how could I modify your query to return the fruit name concatenated to the count in a single string like so:

 apple:2013

Thanks,
Jonathan

0 Karma

somesoni2
Revered Legend

A simple eval statement will do that

above search | eval FRUIT=FRUIT.":".count 
0 Karma

493669
Super Champion

Try this:

index="myindex" URI="myuri" | stats count by FRUIT|stats max(count) as max
0 Karma

jbrenner
Path Finder

That gives me the count, but I want to return the name of the fruit.

Thanks,
Jonathan

0 Karma

493669
Super Champion

ok then try this it will give max count with name of fruit:

index="myindex" URI="myuri" | stats count by FRUIT|stats max(count) as max by FRUIT|head 1
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...