Splunk Search

Get top 20 queries for avarage execution time

marco_carolo
Path Finder

Hello there 😉

 

So, I've extracted from the log, using rex, the time, called OSY_time and each individual slow query, called Query.

I want to get from here a graphs that shows the top 20 queries, for average time, in a specified time range.

| eval seconds = tonumber(trim(OSY_timing)) | streamstats avg(seconds) as sec_avg by Query |sort -sec_avg | top 20 sec_avg

What I want to get is in x axis the query, and in Y the avg_time.

How can I do that?

Thanks for any reply 🙂

Labels (3)
0 Karma

manjunathmeti
Champion

hi @marco_carolo,

Try this and select Visualization.

| eval seconds = tonumber(trim(OSY_timing)) | stats avg(seconds) as sec_avg by Query |sort -sec_avg | head 20 | table Query, sec_avg

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...