Splunk Search

How to get a max point in a given range

minkyuk
Explorer

Hello Splunkians (?).

I have a table of data with 2 fields : host / data_used_mb / _timestamp

host data_used_mb _timestamp
H01 59 12:00
H01 78 13:00
...
H02 15 12:00
H02 20 13:00
...
H06 993 12:00
...

If I were to calculate the MAX of the last 24 hours data points (24 points) for EACH host by rolling them up,

How could I implement this? I looked into "tail" command, but it doesn't take it "by host", or "stats latest(data_used_mb)" which gives only the last point.

Any help from you gus would be highly appreciated!

Jack

Tags (4)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | bucket _time span=1d | stats max(data_used_mb) by _time

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Have you tried simply setting your time range picker to "Last 24 hours"?

If that doesn't work, look into fixing your timestamp extraction.

0 Karma

stephanefotso
Motivator

Hello! Try this: ... earliest=-30d| bucket _time span=1h| stats max(data_used_mb) by host _time

SGF
0 Karma

woodcock
Esteemed Legend

Like this:

... | bucket _time span=1d | stats max(data_used_mb) by _time
0 Karma

minkyuk
Explorer

Okay, but what if I'm ONLY interested in the max of Last 24 points out of say 30 days of hourly data?

0 Karma

woodcock
Esteemed Legend

earliest=-30d | stats list(data_used_mb) AS data_used_mb by host | mvexpand data_used_mb limit=24 | stats max(data_used_mb) by host

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...