---
title: max_by
description: |
  Returns the value of an expression associated with the maximum value of a given sort key.

  * Both `sortKey` and `expression` must be comparable types (`string`, `bool`, `number`, `interval`, `timestamp`, `regexp`, or `enum`).
  * Useful for retrieving details from the row that has the maximum value of another field.
url: https://coralogix.com/docs/dataprime/language-reference/functions-reference/aggregation/max_by/
product: dataengine
feature: DataPrime Language
feature_id: dataprime-language
feature_identifier: dataengine/dataprime-language
last_updated: '2026-10-21'
---

# `max_by`

## Description

Returns the value of an expression associated with the maximum value of a given sort key.

* Both `sortKey` and `expression` must be comparable types (`string`, `bool`, `number`, `interval`, `timestamp`, `regexp`, or `enum`).
* Useful for retrieving details from the row that has the maximum value of another field.

## Syntax

```
max_by(sortKey: T, expression: U): U
```

## Arguments

| Name         | Type | Required | Description                                                                                         |
| ------------ | ---- | -------- | --------------------------------------------------------------------------------------------------- |
| `sortKey`    | `T`  | **true** | Field to maximize. Must be `string`, `bool`, `number`, `interval`, `timestamp`, `regexp`, or `enum` |
| `expression` | `U`  | **true** | Value to return from the row with the maximum `sortKey`. Must be a comparable type                  |

## Example

**Use case: Retrieve details of the latest event per user**

Suppose you want to know the last activity performed by each user. You can use `max` to compute the latest timestamp and `max_by` to extract the associated details.

### Example data

```
{ "username": "chris", "path": "/home", "latency": 320, "ts": 1728919749261000000 },

{ "username": "chris", "path": "/checkout", "latency": 5000, "ts": 1728919759261000000 }
```

### Example query

```
groupby username aggregate max(ts) as ts, max_by(ts, path) as path
```

### Example output

| username | path      | ts                  |
| -------- | --------- | ------------------- |
| chris    | /checkout | 1728919759261000000 |