Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Search result based on max(field)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Log format
ServiceName,ResponseTime,RequestTime,TransactionId
Service1,10,12,12345
Service2,5,8,12346
Service2,7,3,12347
Service1,8,25,12348
Service3,5,4,12349
Service2,10,2,12350
Expected result
| Service Name | Count | Max(ResponseTime) | RequestTime | TransactionId |
|---|---|---|---|---|
| Service1 | 2 | 10 | 12 | 12345 |
| Service2 | 3 | 10 | 2 | 12350 |
| Service3 | 1 | 5 | 4 | 12349 |
I am able to get the service name,count and ResponseTime using the below search. But i need RequestTime and TransactionId based on Max(ResponseTIme). I need the RequestTime and TransactionId of the record which has Max(ResponseTime). Do i really need sub search to get the desired results?
my rex | stats count,max(ResponseTime) by ServiceName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The search should be
my rex |sort 0 - ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName
If your search returns more than 10,000 results then add | sort 0 field
sort command will truncate the output to 10000 rows.
results will be automatically limited to 10000 if you don't specify
| sort 0 field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The search should be
my rex |sort 0 - ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName
If your search returns more than 10,000 results then add | sort 0 field
sort command will truncate the output to 10000 rows.
results will be automatically limited to 10000 if you don't specify
| sort 0 field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why do not you try to sort?
my rex |sort ServiceName,- ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is exactly i was looking for. Thank you very much HiroshiSatoh.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
