Example of how to find out which parts of your application are most used?

[sloshburch]

Does anyone have examples of how to use Splunk to find out which parts of your application are most used?

[sloshburch · Accepted solution]

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application support teams can use the Splunk platform with web access logs to see which web assets are used most. They can use this information to troubleshoot a production issue for a user or to identify areas to improve navigation or performance.

Load data

How to implement: This example use case depends on data from web access logs.

Install the Splunk Add-on for Apache Web Server or the Splunk Add-on for Microsoft IIS. Find the Splunk Add-on for Apache Web Server and the Splunk Add-on for Microsoft IIS on Splunkbase. You can find installation and configuration instructions in the Details tab of each Splunkbase item.

Run the following search to verify you are searching for normalized web data that is ready for this use case:

earliest=-1day index=* tag=web

| head 10

Get insights

Find out which parts of your application are used most to help with troubleshooting and identify areas for improvement.

Run the following search.

index=* tag=web

| stats count BY uri_path

| sort limit=20 -count

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.