MV_MAXedit

Converts a multivalued field into a single valued field containing the maximum value. For example:

ROW a=[3, 5, 1]
| EVAL max_a = MV_MAX(a)
a:integer max_a:integer

[3, 5, 1]

5

It can be used by any field type, including keyword fields. In that case picks the last string, comparing their utf-8 representation byte by byte:

ROW a=["foo", "zoo", "bar"]
| EVAL max_a = MV_MAX(a)
a:keyword max_a:keyword

["foo", "zoo", "bar"]

"zoo"