I need the count, average response time, and stdev response time for top 10 users. I also want to group the rest of users as OTHER, and show the total values. Where should I put "useother=t", or is there any other way to do it?
...|stats count avg(RT) stdev(RT) by UID|addcoltotals
Thanks in advance!
You can't use "useother=t" with stats
. You can use it with top
, but that will not get you the other statistics you want.
This might solve your problem:
<your search here>
| eval EvalUID=if([search <your search here> | top 10 UID showcount=f showperc=f],'UID',"OTHER")
| stats count avg(RT) stdev(RT) by EvalUID
| sort -count
The part inside the [ ] brackets is a subsearch which just gets you your top 10 UID
s in a convenient logical format that can be tested within an if
statement. It assigns a new value EvalUID
to the existing UID
if it's in the top 10, and "OTHER"
if it's not. Now you can use that information in your stats
command. Finally, the sort
shows you the results in order.
Hope this works for you!