I have web page logs that have several fields. The important ones for this are CDN locations
x_edge_location and the response time
How can I first find out top 5
x_edge_location and then do a stats on those top 5 locations for average
Tried the following, does not work
...| top 5 x_edge_location | fields x_edge_location, time_taken | stats avg(time_taken) by x_edge_location
I guess its not working, because top does not return any additional fields other than the field on which top operation is carried out and the count.
| stats count as total avg(timetaken) as Avg by xedge_location | sort 5 -total
Please try this and let me know if this works !