Splunk Search

Highest averages in each category

Explorer

(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname

per host you can have many pnames

what I want is the top 5 with max averages in each host and thier pname

If I do a sort and head, its just going to give me the highest ones across all hosts and that is not what I want.

Tags (1)

Splunk Employee
Splunk Employee

You should use the dedup command to get the top 5 per host:

(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname | sort - host avg(exectime) | dedup 5 host

Explorer

Awesome, thanks.

0 Karma