Sum of Max value on an Aggregation

Graylog Central (peer support)
1

Hi guys,

I’m trying to do an aggregation of a filter that shows me the Sum of a Max value of a field.
Example:
I’ve got 6 log messages.
Those messages have 3 differents IDs (id1, id2 and id3) with multiples values like this table:
image
I need to get the max(Col2) by Col1 and later do a Sum of those max(Col2)
Somenthing like Sum(Max(Col2)) of Col1.

Does anyone have any ideas?

Thank you!

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.