search query | timechart span=1m count by A1
the above query gives me below output:
_time column1 column2 column3
2018-05-25 10:20:05 1 1 0
2018-05-25 10:09:39 4 0 0
2018-05-25 10:27:16 0 2 2
2018-05-25 10:22:06 1 1 1
2018-05-25 10:12:45 1 1 2
2018-05-25 10:25:07 1 1 3
No of columns depends on the time range we choose(i.e) sometimes 3 columns and sometimes 6 columns and so on..
So if the above is my scenario, how I can find max values from each column and their _time value.
My expected output is:
_time column1 column2 column3
2018-05-25 10:09:39 4 0 0
2018-05-25 10:27:16 0 2 2
2018-05-25 10:25:07 1 1 3
so out main aim here is, how we can find max value of columns created dynamically.
Please help me out. I'm struggling with my task.
@maniu1609, try the following search:
<yourBaseSearch>
| bin _time span=1m
| stats count by _time A1
| eventstats max(count) as Maximum by A1
| where count=Maximum
PS: It will list multiple time for A1 if maximum count for specific A1 remains the same in multiple time buckets.
Try something like this
search query | timechart span=1m count by A1
| eventstats max(*) as max*
| eval keep="N"
| foreach max* [| eval keep=if('<<FIELD>>'='<<MATCHSTR>>',"Y",keep) ]
| where keep="Y" | fields - max* keep
it also works for me!!. Thanks!!
@maniu1609, try the following search:
<yourBaseSearch>
| bin _time span=1m
| stats count by _time A1
| eventstats max(count) as Maximum by A1
| where count=Maximum
PS: It will list multiple time for A1 if maximum count for specific A1 remains the same in multiple time buckets.
It works great!!. Thanks!!