Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to get max for each row?

$
0
0
I want to get the max stats_value for each row (that is a sum of stats_values) but my query works in a way that it aggregates ALL the rows instead of each individual row because of the way my input tokens work. How do I make it so each row has its own max value? I have two dropdown inputs that are $routerprefix$ and $numbertok$. $routerprefix$ is which region the router is in so like CA, TX, TN, etc. $numbertok$ is which actual individual router it is like 1, 2, 3 etc, if not chosen then it is '%%'. Here's a simplified query: SELECT distinct device, location, model, (select distinct max(sum(stats_value)) from tbl_device where local_device like '%$routerprefix$%' and device_number like '$numbertok$' group by time_stamp, device) as MAX_STATS from tbl_device where local_device like '%$routerprefix$%' and device_number like '$numbertok$' If I select TX as $routerprefix$ and $numbertok$ is left as the default '%%'..... This is supposed to get this for each row: Device | Location | Model | MAX_STATS TX-Router-1 | Texas | GX100 | 12543.31 TX-Router-2 | Texas | GX100 | 45653.21 TX-Router-3 | Texas | GX100 | 1300.35 But what I'm getting is: Device | Location | Model | MAX_STATS TX-Router-1 | Texas | GX100 | 59496.87 TX-Router-2 | Texas | GX100 | 59496.87 TX-Router-3 | Texas | GX100 | 59496.87 because it's adding all of them together??? Can someone help? Is there any way I could change my input options or query to make it so the MAX reflect the stats_value for EACH row instead of ALL of the routers in one area? Thanks in advance.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>