Splunk Search

Get top 20 queries for avarage execution time

marco_carolo
Path Finder

Hello there 😉

 

So, I've extracted from the log, using rex, the time, called OSY_time and each individual slow query, called Query.

I want to get from here a graphs that shows the top 20 queries, for average time, in a specified time range.

| eval seconds = tonumber(trim(OSY_timing)) | streamstats avg(seconds) as sec_avg by Query |sort -sec_avg | top 20 sec_avg

What I want to get is in x axis the query, and in Y the avg_time.

How can I do that?

Thanks for any reply 🙂

Labels (3)
0 Karma

manjunathmeti
Champion

hi @marco_carolo,

Try this and select Visualization.

| eval seconds = tonumber(trim(OSY_timing)) | stats avg(seconds) as sec_avg by Query |sort -sec_avg | head 20 | table Query, sec_avg

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...