topic How to get timechart for top responsetime URL in Getting Data In

How to get timechart for top responsetime URL

ravir_jbp — Wed, 20 Sep 2023 18:40:45 GMT

I am able to get the list of URL with top response time using below query.

index=xyz earliest=-1hr latest=now | rex field=_raw "^(?\d*\.\d*\.\d*\.\d*)\s\[\w.*\]\s(?\d*)\s\"(?\w*)\s(?\S*)\sHTTP\/1.1\"\s(?\d*)\s(?\d*)\"(?\S*)\"\"\w.*\"\s\S*(?web*\d*)\s\S*" | search sourceLBIP="*" responsetime="*" getorpost="*" uri="*" statuscode="*" responsesize="*" refereralURL="*" node="*" | eval responsetime1=responsetime/1000000 | stats count by responsetime1,node, responsesize, uri, _time, statuscode | sort -responsetime1 | head 1

I am trying to modify this query for more detailed information. I am able to get the top 1 URL which has highest response time. But I need the timechart partner to understand the responsetime trend for that speicifc URL for last 1 hour. Also, like to modify the script in a such a way where it sould provide me the timechart trend of any URL (top responsetime) for 1 hour. URL may not be same every time since it may change.

Re: Need timechart for top responsetime URL

ITWhisperer — Tue, 19 Sep 2023 11:24:51 GMT

If I have understood your requirement correctly, you could try something like this

index=xyz earliest=-1hr latest=now | rex field=_raw "^(?\d*\.\d*\.\d*\.\d*)\s\[\w.*\]\s(?\d*)\s\"(?\w*)\s(?\S*)\sHTTP\/1.1\"\s(?\d*)\s(?\d*)\"(?\S*)\"\"\w.*\"\s\S*(?web*\d*)\s\S*" | search sourceLBIP="*" responsetime="*" getorpost="*" uri="*" statuscode="*" responsesize="*" refereralURL="*" node="*" | eval responsetime1=responsetime/1000000 | eventstats max(responsetime) as max_responsetime | eventstats first(eval(if(responsetime == max_responsetime, uri, null()))) as longest_uri | where uri=longest_uri | chart values(responsetime) by _time longest_uri

Re: Need timechart for top responsetime URL

ravir_jbp — Tue, 19 Sep 2023 10:51:28 GMT

@ITWhisperer , thank you for sharing the query. Seems "| where url=longest_url" condition is not recognizing. I was looking for timechart which can provide me the response time trend for any top response time consuming.

For example, if http://xyz.com/report consuming highest response time. I need the trend for last 1 hour trend on the performance on that specific URL.

Hope that helps

Re: Need timechart for top responsetime URL

ITWhisperer — Tue, 19 Sep 2023 11:25:44 GMT

Typo on my part (updated my response to use uri instead of url)

Re: Need timechart for top responsetime URL

ravir_jbp — Tue, 19 Sep 2023 13:37:02 GMT

@ITWhisperer IT worked !!! thank you so much