Splunk Search

stats\timechart after timechart

reverse
Contributor
| timechart span=10m avg(Value) as AV by Host useother=false 

after running this query - I get desired values for all HOSTS..
Now I want to get MAX of each column for the day ..

Stats wouldn't show anything ..

| stats max(AV) BY Host
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@reverse ,

Try

 "your search"|untable _time,Host,AV |stats max(AV) BY Host

View solution in original post

0 Karma

nareshinsvu
Builder

Agree with Renjith's comments. But if you need to capture the time of the max event as well, then try this.

"your search"
|untable _time Host AV 
|eventstats  max(AV) as max_AV by Host 
| where AV=max_AV 
| table _time Host AV
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@reverse ,

Try

 "your search"|untable _time,Host,AV |stats max(AV) BY Host

View solution in original post

0 Karma

reverse
Contributor

Amazing .. cleared all the clutter too ..
thank you for such a clean solution

0 Karma