Splunk Search

Keep track of max count.


| stats avg(time) as "median", max(time) as MaxMedian max(time99) as "Max99th", max(time999) as Max999th by host

I have something like this, I also want a count of max(99th) by host in past 1hr.

Just make it clear, let say I'm running search for 1hr, I want to calculate max(99th) value every 10mins and display its count by host but, I still want my stats to for whole 1hr.

Say we have host A, B and C
at 00:10 the max(99th) is on host-A
at 00:20 the max(99th) is on host-A
at 00:30 the max(99th) is on host-B

I want to display
host-A median MaxMedian Max99th Max999th "2 times out of 3"
host-B median MaxMedian Max99th Max999th "1 time out of 3"
host-C median MaxMedian Max99th Max999th "0 times out of 3"
Thanks for your time.

0 Karma


oops, sorry.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...