max
Usage#
Syntax#
summarize max(ColumnName)Parameters#
ColumnName: The column or field from which you want to retrieve the maximum value. The column should contain numerical data, timespans, or dates.
Returns#
The maximum value from the specified column.
Use case examples#
In log analysis, you might want to find the longest request duration to diagnose performance issues.
Query
['sample-http-logs']
| summarize max(req_duration_ms)Output
| max_req_duration_ms |
|---|
| 5400 |
This query returns the highest request duration from the req_duration_ms field, which helps you identify the slowest requests.
When analyzing OpenTelemetry traces, you can find the longest span duration to determine performance bottlenecks in distributed services.
Query
['otel-demo-traces']
| summarize max(duration)Output
| max_duration |
|---|
| 00:00:07.234 |
This query returns the longest trace span from the duration field, helping you pinpoint the most time-consuming operations.
In security log analysis, you may want to identify the most recent event for monitoring threats or auditing activities.
Query
['sample-http-logs']
| summarize max(_time)Output
| max_time |
|---|
| 2024-09-25 12:45:01 |
This query returns the most recent timestamp from your logs, allowing you to monitor the latest security events.
List of related aggregations#
- min: Retrieves the minimum value from a column, which is useful when you need to find the smallest or earliest value, such as the lowest request duration or first event in a log.
- avg: Calculates the average value of a column. This function helps when you want to understand the central tendency, such as the average response time for requests.
- sum: Sums all values in a column, making it useful when calculating totals, such as total sales or total number of requests over a period.
- count: Counts the number of records or non-null values in a column. It’s useful for finding the total number of log entries or transactions.
- percentile: Finds a value below which a specified percentage of data falls. This aggregation is helpful when you need to analyze performance metrics like latency at the 95th percentile.
Other query languages#
Splunk SPL users
In Splunk SPL, the max function works similarly, used to find the maximum value in a given field. The syntax in APL, however, requires you to specify the column to aggregate within a query and make use of APL's structured flow.
Splunk example
| stats max(req_duration_ms)APL equivalent
['sample-http-logs']
| summarize max(req_duration_ms)ANSI SQL users
In ANSI SQL, MAX works similarly to APL’s max. In SQL, you aggregate over a column using the MAX function in a SELECT statement. In APL, you achieve the same result using the summarize operator followed by the max function.
SQL example
SELECT MAX(req_duration_ms) FROM sample_http_logs;APL equivalent
['sample-http-logs']
| summarize max(req_duration_ms)