https://community.splunk.com/t5/Splunk-Search/Top-avg-latencies-by-IP/m-p/117813#M31387 <P>I am attempting to get the top offenders of average latency, by their client IP, but limited to the top 50 results, sorted by their latency. This is the search that I have, but I can't figure our why it doesn't return any results. If I remove the 'top' command from the below query, it returns results, but it returns all of them, which isn't as helpful. </P> <P>sourcetype=www NOT hck=* | stats avg(timetaken) by _time,clientip | top timetaken</P> <P>any suggestions would be great! Thank you! </P> Mon, 28 Oct 2013 15:09:35 GMT tmarlette 2013-10-28T15:09:35Z https://community.splunk.com/t5/Splunk-Search/Top-avg-latencies-by-IP/m-p/117813#M31387 <P>I am attempting to get the top offenders of average latency, by their client IP, but limited to the top 50 results, sorted by their latency. This is the search that I have, but I can't figure our why it doesn't return any results. If I remove the 'top' command from the below query, it returns results, but it returns all of them, which isn't as helpful. </P> <P>sourcetype=www NOT hck=* | stats avg(timetaken) by _time,clientip | top timetaken</P> <P>any suggestions would be great! Thank you! </P> Mon, 28 Oct 2013 15:09:35 GMT https://community.splunk.com/t5/Splunk-Search/Top-avg-latencies-by-IP/m-p/117813#M31387 tmarlette 2013-10-28T15:09:35Z https://community.splunk.com/t5/Splunk-Search/Top-avg-latencies-by-IP/m-p/117814#M31388 <P>A few things;</P> <P><CODE>top</CODE> count occurrences, not high/low values. </P> <P><CODE>stats</CODE> removes all the other fields, so after that you only have <CODE>_time</CODE>, <CODE>clientip</CODE> and <CODE>avg(timetaken)</CODE>. </P> <P>Suggest the following;</P> <PRE><CODE>sourcetype=www NOT hck=* | stats avg(timetaken) as TT by _time,clientip | stats max(TT) as XXXX by clientip | sort - XXXX | head 50 </CODE></PRE> <P>/K</P> Mon, 28 Oct 2013 15:43:52 GMT https://community.splunk.com/t5/Splunk-Search/Top-avg-latencies-by-IP/m-p/117814#M31388 kristian_kolb 2013-10-28T15:43:52Z