Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Top X and rare events X in one Report without join

$
0
0

Hello,

i have a search like:

orders=* | transaction order_id

now i want to see the orders who took the longest time (stats max(duration) by order_id) and the one with the fastest (same with min(duration).

how to best display them in the same table. i want to have the fastest 10 and slowest 10. as transaction is an expensive search, i would prefer if i do not need to make a join and run the full search again and correlate them by _time for example. any ideas are welcome.

br matthias


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>