max()

Returns the largest value among the provided arguments.

Syntax

max(EXPR1[, EXPR2, ...])

Parameters

EXPR1, EXPR2, ...
Value expressions to compare. One or more arguments can be specified.

Description

The max() function accepts one or more arguments and returns the largest value among them. Comparison uses Logpresso's internal object comparator, which supports various types including numbers, strings, and timestamps.

Null values are excluded from comparison. Returns null if all arguments are null.

This function is a scalar expression function, not an aggregate function. Use it in the eval command to compare values row by row. For the aggregate version, refer to the max aggregate function.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

  1. Return the larger of the HTTP status code and a reference value.

    table limit=5 WEB_APACHE_SAMPLE | eval result = max(status, 300)
| fields status, result

  2. Return the largest value among string arguments.

    json "{}" | eval m = max("b", "a", "c")
| # m: c

  3. NULL input — returns null when all arguments are null.

    json "{}" | eval m = max(null, null)
| # m: null

Compatibility

The max() function is available since before Sonar 4.0.