Highest averages in each category

[pveeramani]

(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname

per host you can have many pnames

what I want is the top 5 with max averages in each host and thier pname

If I do a sort and head, its just going to give me the highest ones across all hosts and that is not what I want.

[Stephen_Sorkin]

You should use the dedup command to get the top 5 per host:

(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname | sort - host avg(exectime) | dedup 5 host

[pveeramani]

Awesome, thanks.