Finds the largest number for the specified field over a set of events. Result is returned in a field named _max.

Function Traits: Aggregate

ParameterTypeRequiredDefaultDescription
asstringoptional[a]_max Name of output field.
field[b]stringrequired  Field to extract a number from.
typestringoptional[a]  description

[a] Optional parameters use their default value unless explicitly set

[b] The argument name field can be omitted.

The parameter name for field can be omitted; the following forms are equivalent:

logscale
max("value")

and:

logscale
max(field="value")

max() Examples

Return what was the maximum responsetime:

logscale
max(responsetime)

Filter for events in the repository with maximum responsetime values greater than 5 seconds:

logscale
max(responsetime)
|_max> 5