Splunk query: how to differentiate max values after regex - splunk

Question

Let's say I have the following chart:
Input chart
I'm interested only in the 2nd and 4th fields in the 'version' column (e.g. 22.180.0.2)
I want to call all events which has:
Maximum value on both 2nd and 4th fields - as "BEST" (in the example: 22.180.1.3)
(NOT max value on 2nd field) AND (Maximum value on 4th field from each one of the values before the AND, for example 170, 160) - as "GOOD" (in the example: 22.170.0.2,22.160.0.3)
All the rest - as "OK".
I've managed to separate the fields using regex, but couldn't do the differentiation.
Thanks a lot!

Answer 1

I think you want
| rex field=version "(?<first>[0-9]+)\.(?<second>[0-9]+)\.(?<third>[0-9]+)\.(?<fourth>[0-9]+)"
| eventstats max(second) as max_second,
| eventstats max(fourth) as max_fourth by second
| eval status=if(second=max_second and fourth=max_fourth,"BEST",if(second!=max_second and fourth=max_fourth,"GOOD","OK"))
You need two eventstats commands because one of them groups by the second part and the other one doesn't group at all. I don't think there is any way to do it with one eventstats.
Here is a run-anywhere example:
| makeresults
| eval _raw="
index version
1 22.180.0.1
2 22.180.0.2
3 22.180.0.3
4 22.170.0.1
5 22.170.0.2
6 22.160.0.1
7 22.160.0.2
8 22.160.0.3
9 22.160.0.4
"
| multikv forceheader=1 fields index version
| table index version
| rex field=version "(?<first>[0-9]+)\.(?<second>[0-9]+)\.(?<third>[0-9]+)\.(?<fourth>[0-9]+)"
| eventstats max(second) as max_second,
| eventstats max(fourth) as max_fourth by second
| eval status=if(second=max_second and fourth=max_fourth,"BEST",if(second!=max_second and fourth=max_fourth,"GOOD","OK"))
| fields - first second third fourth max_first max_second max_third max_fourth