Splunk Search

Updating maximum value

michaelbosch
Observer

I have a data set with values in a specific moment in time. Each day can have multiple values (but in different events). I want to find the events that have the highest value in that moment in time. For example, if the data is the following:

Day1, 10
Day2, 13
Day2, 12
Day3, 11
Day3, 14
Day 4, 12
Day 5, 15

The search should return that Day1, Day2 (the first row), Day3 (the second row) and Day5 had the highest numbers at the moment they occurred. I do not only want the final highest value but the maximum at that moment in time (like the events after it didn't happen). For example, an additional column can be added which indicates whether it is/was the highest result.

Day1, 10, Yes
Day2, 13, Yes
Day2, 12, No
Day3, 11, No
Day3, 14, Yes
Day 4, 12, No
Day 5, 15, Yes

I have been trying to achieve this with the MAX function but I couldn't get it working. Is it possible to achieve this?

Labels (1)
0 Karma

to4kawa
Ultra Champion
| makeresults count=20
| eval time=random() % 20 + 1
| eval _time=relative_time(_time,"+".time."d@d-1mon")
| bin _time span=1d
| sort _time
| eval data=random() % 30
| table _time data
| rename COMMENT as "this is sample data, check this. from here, the logic"
| eval date_day=strftime(_time,"%d")
| eventstats max(data) as maximum by date_day
| eval check=if(data==maximum,"yes","no")

Not much has changed, though.
You can use eventstats for dates.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @michaelbosch,

the streamstats command is the solution for your need, see this example:

index=_internal
| dedup date_hour timeendpos
| table date_hour timeendpos
| streamstats max(timeendpos) AS max BY date_hour
| eval check=if(timeendpos=max,"Yes","Not")

Ciao.

Giuseppe

0 Karma

michaelbosch
Observer

Thank you for your reply. The results can have different timestamps. Using | streamstats max(timeendpos) AS max BY date_hour, the maximum will be found by date_hour, right? I now use another column to group by and it seems to work now!

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @michaelbosch,

it was a sample to explain to you how to approach the problem!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...