Splunk Search

How to show only the maximum value and showing the condition base on that maximum?

Rithekakan
Path Finder

Hi every one, I want a report which showing only the maximum value (days_since) and show the condition base on the maximum value (Pending_since).
I would be appreciated for your help.

This is my search 
indix=...............
...................
| eval days_since = floor((now() - _time) / 86400)
| eval Pending_since = case(days_since == 0, "Today", days_since < 30, "Pending (< 30 days)", days_since > 45, "Pending ( > 45 days)", days_since > 30, "Pending ( 30>Days<45 )", days_since < 45, "Pending ( 30>Days<45 )", days_since > 1, days_since . " Days")

Rithekakan_0-1659525112570.png

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The screenshot doesn't seem to match sample SPL.  But at the simplest level, would this be useful?

indix=...............
...................
| eval days_since = floor((now() - _time) / 86400)
| stats max(days_since) as days_since by status
| eval Pending_since = case(days_since == 0, "Today", days_since < 30, "Pending (< 30 days)", days_since > 45, "Pending ( > 45 days)", days_since > 30, "Pending ( 30>Days<45 )", days_since < 45, "Pending ( 30>Days<45 )", days_since > 1, days_since . " Days")
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...