I have created the following query, but it doesn't seem to be sorting correctly.
host=somehost* source=*logfile.log | multikv | search *.success | stats avg(Avg_ms_) as avg, min(Min) as min, max(Max) as max, sum(Count) as count by Tag | sort - avg
Here is some sample data.
Performance Statistics 2013-04-23 12:20:00 - 2013-04-23 12:30:00
Tag Avg(ms) Min Max Std Dev Count
someAPI.success 155.0 155 155 0.0 1
someOtherAPI.success 243.0 243 243 0.0 1
yetAnother.success 283.0 283 283 0.0 1
heyLookAnother.success 261.5 192 331 69.5 2
pletheraOfAPI.success 1.0 1 1 0.0 1
tisTrue.success 1769.0 1769 1769 0.0 1
... View more