max (windowcomp)

Use the `max()` function within the `windowcomp` stage to compute the maximum value of a specified field over a window of rows. Unlike the `comp` stage version, the `windowcomp` version preserves all original rows and adds the computed maximum as a new field. This is equivalent to `MAX() OVER(...)` in SQL.

## Syntax

```sql
| windowcomp max(<field>) [by <partition_field1>, <partition_field2>, ...] [sort [asc|desc] <sort_field1>, ...] [between <lower> [and <upper>] [frame_type=rows|range]] [as <alias>]
```

## Parameters

| Name | Type | Required | Description |
| ----------------- | ---------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------- |
| `field` | numeric, string, or datetime | Yes | The field from which to compute the maximum value. |
| `partition_field` | any | No | One or more fields to partition the data by (equivalent to SQL `PARTITION BY`). |
| `sort_field` | any | No | One or more fields to define the order within each partition (equivalent to SQL `ORDER BY`). Defaults to ascending. |
| `lower` | integer or `null` | No | Lower bound of the window frame. `0` = current row, negative = rows before, `null` = unbounded. |
| `upper` | integer or `null` | No | Upper bound of the window frame. `0` = current row, positive = rows after, `null` = unbounded. |
| `frame_type` | `rows` or `range` | No | Type of window frame. `rows` (default) uses physical row offsets; `range` uses value-based offsets on the sort field. |
| `alias` | string | No | An alias for the output field. |

## Returns

**Type**: same as input field

**Description**: The `max()` function returns the maximum value within the defined window for each row. All original rows are preserved.

## Usage notes

* **Row preservation**: Unlike `comp max()`, the `windowcomp max()` does not reduce the number of rows. Each row retains its original data and gets an additional field with the window maximum.
* **No partitioning**: If no `by` clause is specified, the window spans the entire result set.
* **Default frame**: If no window frame is specified, the default frame is from the start of the partition to the current row (`between null and 0`).
* **Null handling**: NULL values are ignored in the computation.
* **Running maximum**: Can be combined with `sort` to compute running maximums.

## Examples

### Example 1: Maximum severity per host (all rows preserved)

**Goal**: Compute the maximum alert severity for each host while preserving all original rows.

**XQL code**:

```sql
dataset = xdr_data
| windowcomp max(alert_severity) by agent_hostname as max_severity_per_host
```

**Explanation**: The `max()` function computes the maximum `alert_severity` within each `agent_hostname` partition. All original rows are preserved, and each row receives the partition's maximum value in `max_severity_per_host`.

**Output**:

| \_TIME | AGENT\_HOSTNAME | ALERT\_SEVERITY | MAX\_SEVERITY\_PER\_HOST |
| ------------------- | --------------- | --------------- | ------------------------ |
| 2024-01-15 08:00:00 | workstation-1 | 3 | 7 |
| 2024-01-15 09:00:00 | workstation-1 | 7 | 7 |
| 2024-01-15 10:00:00 | workstation-1 | 5 | 7 |
| 2024-01-15 08:30:00 | workstation-2 | 2 | 4 |
| 2024-01-15 09:30:00 | workstation-2 | 4 | 4 |

### Example 2: Running maximum over time

**Goal**: Compute a running maximum of bytes sent, ordered by time.

**XQL code**:

```sql
dataset = xdr_data
| windowcomp max(bytes_sent) sort asc _time as running_max_bytes
```

**Explanation**: By sorting on `_time` in ascending order, the `max()` function computes a running maximum of `bytes_sent` from the start of the dataset up to the current row.

**Output**:

| \_TIME | BYTES\_SENT | RUNNING\_MAX\_BYTES |
| ------------------- | ----------- | ------------------- |
| 2024-01-15 08:00:00 | 100 | 100 |
| 2024-01-15 09:00:00 | 250 | 250 |
| 2024-01-15 10:00:00 | 150 | 250 |
| 2024-01-15 11:00:00 | 300 | 300 |

### Example 3: Maximum within a sliding window of 3 rows

**Goal**: Compute the maximum bytes sent within a sliding window of 3 rows (current row plus one row before and one row after).

**XQL code**:

```sql
dataset = xdr_data
| windowcomp max(bytes_sent) sort asc _time between -1 and 1 as local_max
```

**Explanation**: The `between -1 and 1` clause defines a sliding window of 3 rows centered on the current row. The `max()` function returns the maximum `bytes_sent` value within that window for each row.

**Output**:

| \_TIME | BYTES\_SENT | LOCAL\_MAX |
| ------------------- | ----------- | ---------- |
| 2024-01-15 08:00:00 | 100 | 250 |
| 2024-01-15 09:00:00 | 250 | 250 |
| 2024-01-15 10:00:00 | 150 | 300 |
| 2024-01-15 11:00:00 | 300 | 300 |

## Related articles

* **Stages**: [`windowcomp`](../stages/windowcomp), [`comp`](../stages/comp), [`sort`](../stages/sort)
* **Functions**: [`max (comp)`](max_with_comp_stage), [`min()`](min_with_windowcomp_stage), [`greatest()`](greatest)
* **Datasets**: [`xdr_data`](https://docs-cortex.paloaltonetworks.com/r/Cortex-XQL-Schema-Reference-Guide/Introduction)