Ok, I think I figured it out with the help of this answer to get me on the right track.
http://answers.splunk.com/answers/177149/how-to-get-1st-2nd-and-3rd-place-results-based-on.html
index=performancedata|
bucket _time span=1d|
sort _time, user_name, -cpu_mhz_used|
streamstats count as rank by user_name, _time|
where rank < 9|
stats avg(memory_used) by user_name
... View more