| timechart span=10m avg(Value) as AV by Host useother=false
after running this query - I get desired values for all HOSTS..
Now I want to get MAX of each column for the day ..
Stats wouldn't show anything ..
| stats max(AV) BY Host
@reverse ,
Try
"your search"|untable _time,Host,AV |stats max(AV) BY Host
Agree with Renjith's comments. But if you need to capture the time of the max event as well, then try this.
"your search"
|untable _time Host AV
|eventstats max(AV) as max_AV by Host
| where AV=max_AV
| table _time Host AV
@reverse ,
Try
"your search"|untable _time,Host,AV |stats max(AV) BY Host
Amazing .. cleared all the clutter too ..
thank you for such a clean solution