topic Re: Average response time by URL like in Splunk Search

Average response time by URL like

moohkhol — Mon, 28 Sep 2020 16:25:59 GMT

Team,

I want to write a query to generate report to know average response time of certain kind of URLs only , e.g.

sourcetype=access_combined | stats avg(RESP_TIME) by URL where like(URL,"%/suresh%"), avg(RESP_TIME) by URL where like(URL,"%/amaresh%"), avg(RESP_TIME) by URL where like(URL,"%/ramesh%")

When I am writing a query like above it's not giving any result, kind help me for the same.
Please let me know, if need any other details for the same.

Re: Average response time by URL like

richgalloway — Tue, 22 Apr 2014 14:29:57 GMT

There are probably better ways, but I'd do that as three separate searches.

sourcetype=access_combined where like(URL,"%/suresh%") | stats avg(RESP_TIME) as rt_suresh | append [search sourcetype=access_combined where like(URL,"%/amaresh%") | stats avg(RESP_TIME) as rt_amaresh] | append [search sourcetype=access_combined where like(URL,"%/ramesh%") | stats avg(RESP_TIME) as rt_ramesh] | table rt_suresh, rt_amaresh, rt_ramesh

Re: Average response time by URL like

martin_mueller — Tue, 22 Apr 2014 17:30:53 GMT

How 'bout this?

sourcetype=access_combined (shuresh OR amaresh OR ramesh)
| eval url_category = case(like(URL,"%/suresh%"),"suresh",like(URL,"%/amaresh%"),"amaresh",like(URL,"%/ramesh%"),"ramesh")
| search url_category=* | stats avg(RESP_TIME) by url_category

Note, I've made some assumptions about the URLs in the initial search for performance gains. Make sure those assumptions hold for your environment, if they don't then just drop the parenthesised ORs.

Re: Average response time by URL like

moohkhol — Thu, 24 Apr 2014 09:16:23 GMT

Thanks for help but i find below one was better choice.

Re: Average response time by URL like

moohkhol — Thu, 24 Apr 2014 09:16:40 GMT

Thank you very much for your kind help !!!