How to get top 10 users with their avg & stdev response time and group the rest of the users as OTHER value?

[IvyZhang]

I need the count, average response time, and stdev response time for top 10 users. I also want to group the rest of users as OTHER, and show the total values. Where should I put "useother=t", or is there any other way to do it?

...|stats count avg(RT) stdev(RT) by UID|addcoltotals

Thanks in advance!

[aweitzman]

You can't use "useother=t" with stats. You can use it with top, but that will not get you the other statistics you want.

This might solve your problem:

<your search here> 
| eval EvalUID=if([search <your search here> | top 10 UID showcount=f showperc=f],'UID',"OTHER")
| stats count avg(RT) stdev(RT) by EvalUID
| sort -count

The part inside the [ ] brackets is a subsearch which just gets you your top 10 UIDs in a convenient logical format that can be tested within an if statement. It assigns a new value EvalUID to the existing UID if it's in the top 10, and "OTHER" if it's not. Now you can use that information in your stats command. Finally, the sort shows you the results in order.

Hope this works for you!