Splunk Search
Highlighted

How to edit my stats search to get the max totalresponsetime for the top 5 URLs grouped by testtime?

Builder

Need your help,

Can you please help me to get the maximum totalresponsetime for the top 5 URL grouped by testtime? Currently I am getting 5 URL totalresponsetime grouped by testtime, but it's not giving the max value of totalresponsetime in the result,

| top totalresponsetime, url by testtime limit=5 | sort -totalresponsetime| stats list(url), list(totalresponsetime) by testtime

Another way is the search below which gives all URL and totalresponsetime,

index=idxperformancedata | eval totalresponsetime=(compFirstByte+compContent) | transaction testtime   | stats list(url) list(totalresponsetime) by testtime

We want to sort by totalresponsetime desc and show only top 5 in a transaction.

Sample Data:

testtime,url,compFirstByte,compContent
1,url1,1,1
1,url2,2,2
1,url3,3,3
1,url4,4,4
1,url5,5,5
1,url6,6,6
2,url1,1,1
2,url2,2,2
2,url3,3,3
2,url4,4,4
2,url5,5,5
2,url6,6,6
2,url7,7,7

output:


testtime,url,totalresponsetime
1,url6,12
   url5,10
   url4,8
   url3,6
   url2,4
2,url7,14
    url6,12
    url5,10
    url4,8
    url3,6
0 Karma
Highlighted

Re: How to edit my stats search to get the max totalresponsetime for the top 5 URLs grouped by testtime?

SplunkTrust
SplunkTrust

Try something like this

index=idxperformancedata  [search index=idxperformancedata | | top url by testtime limit=5 | table url testtime ]| eval totalresponsetime=(compFirstByte+compContent) | transaction testtime   | stats list(url) list(totalresponsetime) by testtime
0 Karma
Highlighted

Re: How to edit my stats search to get the max totalresponsetime for the top 5 URLs grouped by testtime?

Builder

Thanks somesoni2, i am trying to get high totalresponse time 5 url for each testtime. but this is not giving url and totalresponsetime as highest value ordering. also i have added sample data with output in the description.

0 Karma
Highlighted

Re: How to edit my stats search to get the max totalresponsetime for the top 5 URLs grouped by testtime?

Esteemed Legend

Like this:

index=idxperformancedata | eval totalresponsetime=(compFirstByte+compContent) | sort 0 - totalresponsetime | streamstats global=f window=5 list(url) AS TOPurls list(totalresponsetime) AS TOPtotalresponsetimes by testtime | where mvcount(TOPurls)=5 | dedup testtime | table testtime TOPurls TOPtotalresponsetimes

I freely admit that there are surely far more efficient ways to do this but almost anything will be faster and more reliable than using transaction.

View solution in original post

Highlighted

Re: How to edit my stats search to get the max totalresponsetime for the top 5 URLs grouped by testtime?

Esteemed Legend

Don't forget to click "Accept".

0 Karma