How would I return the value of a correlating field by giving the value of another field...

[jason_hotchkiss]

I am working with a stats table with 7 fields.

| tstats count as "f" where a=* b=*  c=* d=* e=*  by a b c d e
| stats
  sum(f) as f
  list(f) as f_list
  max(f) as f_max
  list(c) as c_list
  list(d) as d_list
  list(e) as e_list
  by b

I would like to be able to take:
  
   b's f_max and match it to the correlating value in b_list, c_list, d_list, e_list, f_list

Anyone able to provide the SPL for this type of search?

[ITWhisperer]

Please can you clarify. You said you are working with 7 fields, by which it appears you mean f, f_list, f_max, c_list, d_list, e_list and b. None of these is a_list or b_list and it isn't clear which is a's f_max.

[jason_hotchkiss]

Oops,

I meant:

b's f_max and match it to the correlating value in b_list, c_list, d_list, e_list, f_list

basically, I am working with the count of events from index, sourcetype, source, host, and a custom field added to tsidx files.

b = sourcetype.  f_max is the largest value found in f_list.  I am trying to determine what values correlate to the c_list, d_list, e_list, and f_list.

Out of all our sources within a sourcetype, which one is the largest, what is its name, where it is coming from, and which group owns it (the customer field).

[ITWhisperer]

Will something like this work for you?

| tstats count as "f" where a=* b=*  c=* d=* e=*  by a b c d e
| eventstats max(f) as f_max  by b
| where f=f_max