Splunk Search

How can I get top x results and then do stats on top x

ashabc
Contributor

I have web page logs that have several fields. The important ones for this are CDN locations x_edge_location and the response time time_taken

How can I first find out top 5 x_edge_location and then do a stats on those top 5 locations for average time_taken?

Tried the following, does not work

...| top 5 x_edge_location | fields x_edge_location, time_taken | stats avg(time_taken) by x_edge_location

I guess its not working, because top does not return any additional fields other than the field on which top operation is carried out and the count.

0 Karma
1 Solution

immortalraghava
Path Finder

| stats count as total avg(time_taken) as Avg by x_edge_location | sort 5 -total

Please try this and let me know if this works !

View solution in original post

immortalraghava
Path Finder

| stats count as total avg(time_taken) as Avg by x_edge_location | sort 5 -total

Please try this and let me know if this works !

ashabc
Contributor

Wow! Why I did not think that way. That is what exactly I was looking for. Thank you.

0 Karma

ashabc
Contributor

It will be nice to have a feature like this.

| stats avg(time_taken) by top 5 x_edge_location

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...