max after stats, chart

[jrodriguezap]

Hi, I have a result that comes from: search ... | stats count by MB

MB   count
3.1   4
2.8   2
3.6   1
2.3   5
3.5   1

I would get the count value has more:

MB   count
2.3   5

With that it would be possible?
I appreciate your help.
Greetings.

[sowings · Accepted solution]

In this case, I would set up a new field with eventstats (it leaves the original set alone), and then search for where they're equal:


YOUR_SEARCH_HERE | stats count by MB | eventstats max(count) AS max | where count=max


[jrodriguezap]

Thank you. I was of help, I had to add the same for the MB column, because when he heard the count for several MB, leaving several.

...| stats count by MB | eventstats max(count) AS maxCount | where count=maxCount | eventstats max(MB) AS maxMB| where MB=maxMB | fields MB