Average time on only top results

[jevenson]

I'm trying to get the top 10 uri's from our IIS logs, and get the average time taken on each of those. I can't quite figure out how to do it. If I use the top command, when I pipe it to a chart I no longer have the time_taken field.

This search works, but it returns all uri's, and I just want the top 10. There's got to be a way to do this.

sourcetype=iis | fields time_taken, cs_uri_stem | chart avg(time_taken) by cs_uri_stem

[sowings · Accepted solution]

Start with a subsearch to find the top 10 URIs, then run a search to find average time:

[ search sourcetype=iis | fields cs_uri_stem | top limit=10 showperc=f showcount=f cs_uri_stem ]
sourcetype = iis | fields cs_uri_stem time_taken | chart avg(time_taken) by cs_uri_stem

[jevenson]

This is exactly what I needed. Thanks!