Splunk Search

find max of two averaged fields over a month of daily data

dang
Path Finder

I've got a very basic query which computes an average of some daily attempts to do something like this:

index=monitoring | timechart span=1d sum(done) as Success sum(try) as Attempt | eval Percent=round(Success*100/Attempt,2) | convert ctime(_time) as Date timeformat="%d %B" | fields - _time | fields Date Percent 

I'm unclear how I could find the day with the highest value of "Percent" over a month's worth of daily valules. Would I need to create a summary index to handle this?

Tags (3)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can find the single highest day by sorting by Percent, descending, and taking the first row:

index=monitoring
| timechart span=1d sum(done) as Success sum(try) as Attempt
| eval Percent=round(Success*100/Attempt,2)
| convert ctime(_time) as Date timeformat="%d %B"
| fields - _time
| fields Date Percent
| sort - Percent
| head 1

Alternately you can tag the highest row using eventstats and eval:

index=monitoring
| timechart span=1d sum(done) as Success sum(try) as Attempt
| eval Percent=round(Success*100/Attempt,2)
| convert ctime(_time) as Date timeformat="%d %B"
| fields - _time
| fields Date Percent
| eventstats max(Percent) as max_Percent
| eval is_highest = if(Percent == max_Percent, "yes", "no")

View solution in original post

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can find the single highest day by sorting by Percent, descending, and taking the first row:

index=monitoring
| timechart span=1d sum(done) as Success sum(try) as Attempt
| eval Percent=round(Success*100/Attempt,2)
| convert ctime(_time) as Date timeformat="%d %B"
| fields - _time
| fields Date Percent
| sort - Percent
| head 1

Alternately you can tag the highest row using eventstats and eval:

index=monitoring
| timechart span=1d sum(done) as Success sum(try) as Attempt
| eval Percent=round(Success*100/Attempt,2)
| convert ctime(_time) as Date timeformat="%d %B"
| fields - _time
| fields Date Percent
| eventstats max(Percent) as max_Percent
| eval is_highest = if(Percent == max_Percent, "yes", "no")
0 Karma

dang
Path Finder

Thanks, Stephen. I'll probably use the first example, but the second one will help me learn new stuff about streamstats.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...