Splunk Search

Get top 20 queries for avarage execution time

marco_carolo
Path Finder

Hello there :winking_face:

 

So, I've extracted from the log, using rex, the time, called OSY_time and each individual slow query, called Query.

I want to get from here a graphs that shows the top 20 queries, for average time, in a specified time range.

| eval seconds = tonumber(trim(OSY_timing)) | streamstats avg(seconds) as sec_avg by Query |sort -sec_avg | top 20 sec_avg

What I want to get is in x axis the query, and in Y the avg_time.

How can I do that?

Thanks for any reply :slightly_smiling_face:

Labels (3)
0 Karma

manjunathmeti
Champion

hi @marco_carolo,

Try this and select Visualization.

| eval seconds = tonumber(trim(OSY_timing)) | stats avg(seconds) as sec_avg by Query |sort -sec_avg | head 20 | table Query, sec_avg

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...