https://community.splunk.com/t5/Splunk-Search/Get-top-20-queries-for-avarage-execution-time/m-p/549766#M156016 <P>Hello there <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P><P>&nbsp;</P><P>So, I've extracted from the log, using rex, the time, called OSY_time and each individual slow query, called Query.</P><P>I want to get from here a graphs that shows the top 20 queries, for average time, in a specified time range.</P><P>| eval seconds = tonumber(trim(OSY_timing)) | streamstats avg(seconds) as sec_avg by Query |sort -sec_avg | top 20 sec_avg</P><P>What I want to get is in x axis the query, and in Y the avg_time.</P><P>How can I do that?</P><P>Thanks for any reply <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 29 Apr 2021 08:02:14 GMT marco_carolo 2021-04-29T08:02:14Z https://community.splunk.com/t5/Splunk-Search/Get-top-20-queries-for-avarage-execution-time/m-p/549766#M156016 <P>Hello there <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P><P>&nbsp;</P><P>So, I've extracted from the log, using rex, the time, called OSY_time and each individual slow query, called Query.</P><P>I want to get from here a graphs that shows the top 20 queries, for average time, in a specified time range.</P><P>| eval seconds = tonumber(trim(OSY_timing)) | streamstats avg(seconds) as sec_avg by Query |sort -sec_avg | top 20 sec_avg</P><P>What I want to get is in x axis the query, and in Y the avg_time.</P><P>How can I do that?</P><P>Thanks for any reply <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 29 Apr 2021 08:02:14 GMT https://community.splunk.com/t5/Splunk-Search/Get-top-20-queries-for-avarage-execution-time/m-p/549766#M156016 marco_carolo 2021-04-29T08:02:14Z https://community.splunk.com/t5/Splunk-Search/Get-top-20-queries-for-avarage-execution-time/m-p/549786#M156028 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/233874">@marco_carolo</a>,<BR /><BR />Try this and select Visualization.</P><LI-CODE lang="markup">| eval seconds = tonumber(trim(OSY_timing)) | stats avg(seconds) as sec_avg by Query |sort -sec_avg | head 20 | table Query, sec_avg</LI-CODE><P>&nbsp;</P><P>If this reply helps you, a like would be appreciated.</P> Thu, 29 Apr 2021 09:02:57 GMT https://community.splunk.com/t5/Splunk-Search/Get-top-20-queries-for-avarage-execution-time/m-p/549786#M156028 manjunathmeti 2021-04-29T09:02:57Z