Splunk Search

Can any one help to understand & use of below command in eval

maheshsat
Explorer

Can any one help to understand & use of below command in eval
index=_internal | eval Mahesh=max(1, 3, 6, 7, "foo", field)

Tags (1)
0 Karma

niketn
Legend

@maheshsat, please add a context as to why and where is this being applied. What are the typical values in field? Is it numeric or string?

Max will pull the highest in the list. Other way to analyze would be of you reverse sorted values, which value will be the first.

| makeresults 
| eval field=1000 
| map search="| makeresults
| eval data=\"1,3,6,179,foo,$field$\"" 
| makemv data delim="," 
| mvexpand data 
| sort - data 
| head 1

PS: Take out head 1 command o see ranking of each values. Also change field value to its max value(string or number) to be added to the query.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...