topic Re: search query based on response time in Splunk Search

search query based on response time

subhadipc — Mon, 28 Sep 2020 11:40:19 GMT

I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 such pages ordered by their count. I wrote the following search query, but did not get success. Please help.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | stats count as cnt by cs_uri_stem | sort cnt 10 -

Re: search query based on response time

BobM — Thu, 12 Apr 2012 15:08:54 GMT

The only thing I can see wrong (assuming the fields exist in your data) is the sort command.
Try

| sort - cnt limit=10

but it would probably be easier to use the top command.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | top cs_uri_stem showperc=f

Bob

Re: search query based on response time

subhadipc — Mon, 28 Sep 2020 11:40:33 GMT

Another way is to write the following query:

Using this, one may replace xx with the number, e.g. 10 as in the question

Re: search query based on response time

BobM — Fri, 13 Apr 2012 14:46:24 GMT

adding limit=10 to the sort command does the same as head but is more efficient as splunk doesn't have to sort all lines.

The top comand by default returns 10 but you can change it by adding limit=xx to any number you want.