max_of
Use max_of when you want to:
- Compare multiple fields in a single event to determine the highest value.
- Perform element-wise maximum calculations in datasets where values are spread across columns.
- Evaluate conditional values and select the highest one on a per-row basis.
- Ensure a minimum value. For example,
max_of(value, 0)always returns greater than 0.
Usage#
Syntax#
max_of(Expr1, Expr2, ..., ExprN)Parameters#
The function takes a comma-separated list of expressions to compare. All values must be of the same type.
Returns#
The function returns the maximum value among the input expressions. The type of the result matches the type of the input expressions. All expressions must be of the same or compatible types.
Use case example#
You have two data points for the size of HTTP responses: header size and body size. You want to find the maximum of these two values for each event.
Query
['sample-http-logs']
| extend max_size = max_of(resp_header_size_bytes, resp_body_size_bytes)
| project _time, id, resp_header_size_bytes, resp_body_size_bytes, max_sizeOutput
| _time | id | resp_header_size_bytes | resp_body_size_bytes | max_size |
|---|---|---|---|---|
| May 15, 11:18:53 | 4baad81e-2bca-408f-8a47-092065274037 | 39 B | 2,805 B | 2,805 |
| May 15, 11:18:53 | 05b257c0-8f9d-4b23-8901-c5f288abc30b | 24 B | 988 B | 988 |
| May 15, 11:18:53 | b34d937c-527a-4a05-b88f-5f3dba645de6 |
72 B | 4,399 B | 4,399 |
| May 15, 11:18:53 | 12a623ec-8b0d-4149-a9eb-d3e18ad5b1cd | 34 B | 1,608 B | 1,608 |
| May 15, 11:18:53 | d24f22a7-8748-4d3d-a815-ed93081fd5d1 |
84 B | 4,080 B | 4,080 |
| May 15, 11:18:53 | 3cc68be1-bb9a-4199-bf75-62eef59e3a09 | 76 B | 5,117 B | 5,117 |
| May 15, 11:18:53 | abadabac-a6c0-4ff2-80a1-11143d7c408b |
41 B | 2,845 B | 2,845 |
Other query languages#
Splunk SPL users
Splunk doesn’t provide a direct function equivalent to max_of. However, you can use the eval command with nested if statements or custom logic to emulate similar functionality on a per-event basis.
Splunk example
eval max_value=if(a > b and a > c, a, if(b > c, b, c))APL equivalent
extend max_value = max_of(a, b, c)ANSI SQL users
ANSI SQL doesn’t offer a built-in function like max_of to compute the maximum across expressions in a single row. Instead, you typically use GREATEST, which serves a similar purpose.
SQL example
SELECT GREATEST(a, b, c) AS max_value FROM tableAPL equivalent
extend max_value = max_of(a, b, c)