Splunk Search

How to find min and max per hour during day by host ?

exmuzzy
Explorer

If I use such SPL

index=_internal 
 | timechart span=1h count by host
 | stats max(*) AS *."max", min(*) as *."min" | transpose

this produce min and max mixed in one column but I would like separate max and min column

0 Karma

kunalmao
Communicator

Can you please give a view of how you want the result and min and max of what ?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi exmuzzy,
let me understand: do you want max in a column and min in another one?
if this is your requirement delete the transpose command!

 index=_internal 
  | timechart span=1h count by host
  | stats max(*) AS *."max", min(*) as *."min" 

Bye.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi exmuzzy,
I have

giuseppe-pc.max giuseppe-pc.min
       102494           0

Bye.
Giuseppe

0 Karma

exmuzzy
Explorer

No, I would like to rich such result

                              max       min

giuseppe-pc 0 334
backeтd 12 502

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi exmuzzy,
did you tried?

index=_internal 
| bin_time span=1h
| chart max(count) AS Max  min(count) as Min BY host

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...