Splunk Search

How can I get top x results and then do stats on top x

ashabc
Contributor

I have web page logs that have several fields. The important ones for this are CDN locations x_edge_location and the response time time_taken

How can I first find out top 5 x_edge_location and then do a stats on those top 5 locations for average time_taken?

Tried the following, does not work

...| top 5 x_edge_location | fields x_edge_location, time_taken | stats avg(time_taken) by x_edge_location

I guess its not working, because top does not return any additional fields other than the field on which top operation is carried out and the count.

0 Karma
1 Solution

immortalraghava
Path Finder

| stats count as total avg(time_taken) as Avg by x_edge_location | sort 5 -total

Please try this and let me know if this works !

View solution in original post

immortalraghava
Path Finder

| stats count as total avg(time_taken) as Avg by x_edge_location | sort 5 -total

Please try this and let me know if this works !

View solution in original post

ashabc
Contributor

Wow! Why I did not think that way. That is what exactly I was looking for. Thank you.

0 Karma

ashabc
Contributor

It will be nice to have a feature like this.

| stats avg(time_taken) by top 5 x_edge_location

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!