Splunk Search

Highest averages in each category

pveeramani
Explorer

(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname

per host you can have many pnames

what I want is the top 5 with max averages in each host and thier pname

If I do a sort and head, its just going to give me the highest ones across all hosts and that is not what I want.

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

You should use the dedup command to get the top 5 per host:

(index=hosts) startminutesago="10" | stats avg(exectime) by host, pname | sort - host avg(exectime) | dedup 5 host

pveeramani
Explorer

Awesome, thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...