- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Search result based on max(field)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Log format
ServiceName,ResponseTime,RequestTime,TransactionId
Service1,10,12,12345
Service2,5,8,12346
Service2,7,3,12347
Service1,8,25,12348
Service3,5,4,12349
Service2,10,2,12350
Expected result
| Service Name | Count | Max(ResponseTime) | RequestTime | TransactionId |
|---|---|---|---|---|
| Service1 | 2 | 10 | 12 | 12345 |
| Service2 | 3 | 10 | 2 | 12350 |
| Service3 | 1 | 5 | 4 | 12349 |
I am able to get the service name,count and ResponseTime using the below search. But i need RequestTime and TransactionId based on Max(ResponseTIme). I need the RequestTime and TransactionId of the record which has Max(ResponseTime). Do i really need sub search to get the desired results?
my rex | stats count,max(ResponseTime) by ServiceName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The search should be
my rex |sort 0 - ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName
If your search returns more than 10,000 results then add | sort 0 field
sort command will truncate the output to 10000 rows.
results will be automatically limited to 10000 if you don't specify
| sort 0 field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The search should be
my rex |sort 0 - ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName
If your search returns more than 10,000 results then add | sort 0 field
sort command will truncate the output to 10000 rows.
results will be automatically limited to 10000 if you don't specify
| sort 0 field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why do not you try to sort?
my rex |sort ServiceName,- ResponseTime |stats count,max(ResponseTime) ,first(RequestTime),first(TransactionId) by ServiceName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is exactly i was looking for. Thank you very much HiroshiSatoh.
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
