I created an Agg Based Metric with:
Max Bucket aggregation, that has bucket terms agg for source IP, which basically counts the top source IP and returns it
Date Histogram with timestamp field, with minimal interval of 1 min.
That combination returns multiple results (based on selected time frame) in 1 min bucket, each with a value (doc count) that represents the top source acted at this minute, see below:
I'd like to return only the highest result (highlighted in YELLOW), so that the metric will show a single value which represent the highest actor in the selected timeframe.
How can I achive it in agg based metric/other metric type?
• could json input field on the BUCKETS section assist with selecting the top result (can't seem to get it to work, I lack of the right syntax I guess)
Appreciate your help.