Learn more about the Cortex Query Language max
aggregate comp function that returns the maximum value seen for the field in the result set.
Syntax
comp max(<field>) [as <alias>] by <field_1>,<field_2> [addrawdata = true|false as <target field>]
Description
The max
aggregation is a comp function that returns the maximum value of an integer field, for all records that contain matching values for the fields identified in the by
clause.
In addition, you can configure whether the raw data events are displayed by setting addrawdata
to either true
or false
(default), which are used to configure the final comp
results. When including raw data events in your query, the query runs for up to 50 fields that you define and displays up to 100 events.
Examples
Return the maximum value of the action_total_download
field for all records that have matching values for their actor_process_image_path
and actor_process_command_line
values. The query returns a maximum of 100 xdr_data
records and includes a raw_data
column listing the raw data events used to display the final comp
results.
dataset = xdr_data | fields actor_process_image_path as Process_Path, actor_process_command_line as Process_CMD, action_total_download as Download | filter Download > 0 | limit 100 | comp max(Download) as max_download by Process_Path, Process_CMD addrawdata = true as raw_data