I have web page logs that have several fields. The important ones for this are CDN locations x_edge_location and the response time time_taken
How can I first find out top 5 x_edge_location and then do a stats on those top 5 locations for average time_taken?
Tried the following, does not work
...| top 5 x_edge_location | fields x_edge_location, time_taken | stats avg(time_taken) by x_edge_location
I guess its not working, because top does not return any additional fields other than the field on which top operation is carried out and the count.
| stats count as total avg(time_taken) as Avg by x_edge_location | sort 5 -total
Please try this and let me know if this works !
View solution in original post
Wow! Why I did not think that way. That is what exactly I was looking for. Thank you.
It will be nice to have a feature like this.
| stats avg(time_taken) by top 5 x_edge_location