Splunk Search

Top avg latencies by IP

tmarlette
Motivator

I am attempting to get the top offenders of average latency, by their client IP, but limited to the top 50 results, sorted by their latency. This is the search that I have, but I can't figure our why it doesn't return any results. If I remove the 'top' command from the below query, it returns results, but it returns all of them, which isn't as helpful.

sourcetype=www NOT hck=* | stats avg(timetaken) by _time,clientip | top timetaken

any suggestions would be great! Thank you!

Tags (2)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

A few things;

top count occurrences, not high/low values.

stats removes all the other fields, so after that you only have _time, clientip and avg(timetaken).

Suggest the following;

sourcetype=www NOT hck=* | stats avg(timetaken) as TT by _time,clientip | stats max(TT) as XXXX by clientip | sort - XXXX | head 50 

/K

View solution in original post

kristian_kolb
Ultra Champion

A few things;

top count occurrences, not high/low values.

stats removes all the other fields, so after that you only have _time, clientip and avg(timetaken).

Suggest the following;

sourcetype=www NOT hck=* | stats avg(timetaken) as TT by _time,clientip | stats max(TT) as XXXX by clientip | sort - XXXX | head 50 

/K

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...