Hello,
I have this search query
index=app iNumber IN (72061271737983, 72061271737983, 72061274477906, 72061277215167) | stats count by notificationId, iNumber
This results in multiple notificationIds coming in for each iNumber in this list. What im trying to find out is the max notificationId value per iNumber, and output that list. Is there a way to do that?
somthing like:
iNumber | (Max)NotificationId |
72061271737983 | 12345 |
72061271737983 | 78787 |
Thank you!
| stats max(notificationId) by iNumber