topic Re: How to use stats command after top command. in Splunk Search

How to use stats command after top command.

rakshithreddy — Thu, 15 Jun 2017 05:26:18 GMT

Hi all
I am trying to do the following search.
which would result in Top 5 apiname values along with their apitime(avg,min,max) values included but unable to get the list the data.

index=cub source=xyz.log
|top limit=5 apiName
|stats avg(apiTime),min(apiTime),max(apiTime) by apiName

Thank you.

Re: How to use stats command after top command.

somesoni2 — Thu, 15 Jun 2017 15:39:47 GMT

After top you only left with 5 records of most occuring apiName, corresponding count and percentage. There is no apiTime field available so the stats fails. Try like this

index=cub source=xyz.log
|stats count avg(apiTime),min(apiTime),max(apiTime) by apiName
| eventstats sum(count) as total | eval perc=count*100/total
| sort 5 -count | fields - total

Re: How to use stats command after top command.

woodcock — Thu, 15 Jun 2017 23:30:11 GMT

Like this:

index=cub source=xyz.log
[ index=cub source=xyz.log
| top limit=5 apiName 
| fields apiName ] 
| stats avg(apiTime) min(apiTime) max(apiTime) BY apiName

Re: How to use stats command after top command.

woodcock — Thu, 15 Jun 2017 23:31:15 GMT

This answer is better; mine is mainly for education because it is more like how you were trying to solve it (but don't use it).

Re: How to use stats command after top command.

DalJeanis — Fri, 16 Jun 2017 03:33:48 GMT

Hmmm. Seems like it would be possible to substitute a tstats command into the subsearch that would make it more efficient than somesoni2's version, solely when there is a high cardinality for apiName and/or a longer time period that makes the stats expensive...