How to edit my stats search to get the max totalresponsetime for the top 5 URLs grouped by testtime?

[dhavamanis]

Need your help,

Can you please help me to get the maximum totalresponsetime for the top 5 URL grouped by testtime? Currently I am getting 5 URL totalresponsetime grouped by testtime, but it's not giving the max value of totalresponsetime in the result,

| top totalresponsetime, url by testtime limit=5 | sort -totalresponsetime| stats list(url), list(totalresponsetime) by testtime

Another way is the search below which gives all URL and totalresponsetime,

index=idxperformancedata | eval totalresponsetime=(compFirstByte+compContent) | transaction testtime   | stats list(url) list(totalresponsetime) by testtime

We want to sort by totalresponsetime desc and show only top 5 in a transaction.

Sample Data:

testtime,url,compFirstByte,compContent
1,url1,1,1
1,url2,2,2
1,url3,3,3
1,url4,4,4
1,url5,5,5
1,url6,6,6
2,url1,1,1
2,url2,2,2
2,url3,3,3
2,url4,4,4
2,url5,5,5
2,url6,6,6
2,url7,7,7

output:


testtime,url,totalresponsetime
1,url6,12
   url5,10
   url4,8
   url3,6
   url2,4
2,url7,14
    url6,12
    url5,10
    url4,8
    url3,6

[woodcock · Accepted solution]

Like this:

index=idxperformancedata | eval totalresponsetime=(compFirstByte+compContent) | sort 0 - totalresponsetime | streamstats global=f window=5 list(url) AS TOPurls list(totalresponsetime) AS TOPtotalresponsetimes by testtime | where mvcount(TOPurls)=5 | dedup testtime | table testtime TOPurls TOPtotalresponsetimes

I freely admit that there are surely far more efficient ways to do this but almost anything will be faster and more reliable than using transaction.

[woodcock]

Don't forget to click "Accept".

[somesoni2]

Try something like this

index=idxperformancedata  [search index=idxperformancedata | | top url by testtime limit=5 | table url testtime ]| eval totalresponsetime=(compFirstByte+compContent) | transaction testtime   | stats list(url) list(totalresponsetime) by testtime

[dhavamanis]

Thanks somesoni2, i am trying to get high totalresponse time 5 url for each testtime. but this is not giving url and totalresponsetime as highest value ordering. also i have added sample data with output in the description.