Splunk Search

Get top 20 queries for avarage execution time

marco_carolo
Path Finder

Hello there 😉

 

So, I've extracted from the log, using rex, the time, called OSY_time and each individual slow query, called Query.

I want to get from here a graphs that shows the top 20 queries, for average time, in a specified time range.

| eval seconds = tonumber(trim(OSY_timing)) | streamstats avg(seconds) as sec_avg by Query |sort -sec_avg | top 20 sec_avg

What I want to get is in x axis the query, and in Y the avg_time.

How can I do that?

Thanks for any reply 🙂

Labels (3)
0 Karma

manjunathmeti
Champion

hi @marco_carolo,

Try this and select Visualization.

| eval seconds = tonumber(trim(OSY_timing)) | stats avg(seconds) as sec_avg by Query |sort -sec_avg | head 20 | table Query, sec_avg

 

If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...