Splunk Search

How to show only the maximum value and showing the condition base on that maximum?

Rithekakan
Path Finder

Hi every one, I want a report which showing only the maximum value (days_since) and show the condition base on the maximum value (Pending_since).
I would be appreciated for your help.

This is my search 
indix=...............
...................
| eval days_since = floor((now() - _time) / 86400)
| eval Pending_since = case(days_since == 0, "Today", days_since < 30, "Pending (< 30 days)", days_since > 45, "Pending ( > 45 days)", days_since > 30, "Pending ( 30>Days<45 )", days_since < 45, "Pending ( 30>Days<45 )", days_since > 1, days_since . " Days")

Rithekakan_0-1659525112570.png

 

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The screenshot doesn't seem to match sample SPL.  But at the simplest level, would this be useful?

indix=...............
...................
| eval days_since = floor((now() - _time) / 86400)
| stats max(days_since) as days_since by status
| eval Pending_since = case(days_since == 0, "Today", days_since < 30, "Pending (< 30 days)", days_since > 45, "Pending ( > 45 days)", days_since > 30, "Pending ( 30>Days<45 )", days_since < 45, "Pending ( 30>Days<45 )", days_since > 1, days_since . " Days")
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...