page="MIR" postid="2824567904373133_10151428930538134" message="Foot stools from MI..." time="2013-01-21" likes="188" comments="9" fromid="282904373133" picCount="1" videocount="0" linlcount="0" shares="0"
tried this query: sourcetype="..." |stats max(likes) as likes by page| table page,likes, message
My intention is to display a message with max likes but the above query does not work
Use the following command to get a list which contains pages and max likes as columns :
.... | chart max(likes) AS Likes by page
Have a look at following Splunk Documentation :
link text