(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname
per host you can have many pnames
what I want is the top 5 with max averages in each host and thier pname
If I do a sort and head, its just going to give me the highest ones across all hosts and that is not what I want.
You should use the dedup
command to get the top 5 per host:
(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname | sort - host avg(exectime) | dedup 5 host
Awesome, thanks.