query for top value

[DTERM]

Let's say you have a log that looks like....

X -- Y -- Z

=== === ===

AAA BBB 123

AAA BBB 356

YYY ZZZ 800

AAA BBB 900

YYY ZZZ 345

What query would allow me to extract the highest number Z where X and Y are equal.

So for the example above, I would expect to see results like:

AAA BBB 900

YYY ZZZ 800

Thanks.

[kristian_kolb · Accepted solution]

Well, depending on the nature of X and Y, there are a couple of options, one of them being a simple string concatenation for the comparison:

... | eval Q = X." ".Y | stats max(Z) AS Z by Q | rename Q AS "X and Y"

which would give you a table like;

X and Y          Z
AAA BBB          900
CCC DDD          800

Hope this helps,

Krisitan

[DTERM]

Thanks much!!

[kristian_kolb]

The dot (.) is the concatenation operator; so the eval statement creates the 'AAA BBB' and 'CCC DDD' strings, which appear under the 'X and Y' heading.

Of course, this could have been illustrated better with proper log events.

The reason for doing so is that you'll need to find the highest value for the combination of A and Y.

/k

[DTERM]

Perfect. Thanks so much!! But can you explain the "eval Q = X." ".Y" portion of that. I don't quite get that...

[Ayn]

Explain how X and Y are equal in the lines you're expecting to see? Also, do you mean that the actual log event looks like this in a kind of tabular format?