I'm working with Alert logs, which spit out log events only if certain SQL queries take longer than a threshold time. Each log event has two values of interest - QueryTime and SQLQuery. I'm extracting these fields.
I'd like to run a "top limit=50 SQLQuery showperc=f" and I'd like to add a column to show "avg(QueryTime) by SQLQuery". Can't figure out a way to do both in the same search. The end result should have the following headers:
SQLQuery avg(QueryTime) Count
That worked as required. Thanks!