Splunk Search

Displaying largest value from Multiple Extractions in each Event

raby1996
Path Finder

Hi all,

I have multiple events where in each individual event, I'm extracting multiple fields using regex. Essentially it looks like this where each BU is a separate field I'm extracting from the event:

BU1 - 84.5xx.x
BU2- 83.5xx.x
BU3- 83.6xx.x
BU4- 85.xxx.x

I want to compare all extracted fields from each individual event and display only the the highest number as another field lets say largest_BU. Is there any way to do this?
Thank you in advance.

0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, like this:

...| eval largest_BU=0 | foreach BU* [ eval largest_BU=max(largest_BU, <<FIELD>>) ]

View solution in original post

woodcock
Esteemed Legend

Yes, like this:

...| eval largest_BU=0 | foreach BU* [ eval largest_BU=max(largest_BU, <<FIELD>>) ]

raby1996
Path Finder

Thank you, and as a side note it also worked when i set my rex to search for that specific pattern with a max_match=0, then i just use eval max

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...