Splunk: How to implement "max(Index) by Version"

Eitan Zair 0
Viewed 14

I have "version" and "Index" variables

"Version" contains values like: 150,160,170...
"Index" contains values like: 1,2,3,4,5

Basically I want to know if there's an implementation for this kind of condition:

max(Index) by Version

Meaning for the below 6 events:
150 , 5
140 , 1
140 , 2
130 , 1
130 , 2
130 , 3
Ill get only those 3:
150 , 5
140 , 2
130 , 3
Because it has only the highest index for every version

Thanks!

Couldn't implement this from Splunk documentation:

Aggregation

max([by=<grp>])

When you call max(by=<grp>), it returns one maximum for each value of the property or properties specified by <grp>. For example, if the input stream contains 5 different values for the property named datacenter, max(by='datacenter') outputs 5 maximums.

splunk
3 Answers

You can use the stats command to find the maximum Index value for each Version.

| stats max(Index) by Version
RichG0

Basically I want to know if there's an implementation for this kind of condition:

max(Index) by Version

What you're asking for seem to be precisely how you would call max with stats:

index=ndx sourcetype=srctp Version=* datacenter=*
| stats max(Version) by datacenter

Does that not do what you're looking for?

userSa10

Thanks guys! Eventually what was the trick was "eventstats", because I wanted the highest index for each event

Eitan Zair0
Related