Splunk Search

Get top 20 queries for avarage execution time

marco_carolo
Path Finder

Hello there 😉

 

So, I've extracted from the log, using rex, the time, called OSY_time and each individual slow query, called Query.

I want to get from here a graphs that shows the top 20 queries, for average time, in a specified time range.

| eval seconds = tonumber(trim(OSY_timing)) | streamstats avg(seconds) as sec_avg by Query |sort -sec_avg | top 20 sec_avg

What I want to get is in x axis the query, and in Y the avg_time.

How can I do that?

Thanks for any reply 🙂

Labels (3)
0 Karma

manjunathmeti
Champion

hi @marco_carolo,

Try this and select Visualization.

| eval seconds = tonumber(trim(OSY_timing)) | stats avg(seconds) as sec_avg by Query |sort -sec_avg | head 20 | table Query, sec_avg

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...