All Apps and Add-ons

Example of how to identify slow web pages?

sloshburch
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to identify slow web pages?

0 Karma
1 Solution

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application developers can use web server access logs to summarize the response times of each page and identify the worst performing pages so that development teams can improve application performance.

Load data

How to implement: This example use case depends on data from web server logs.

Install the Splunk Add-on for Apache Web Server or the Splunk Add-on for Microsoft IIS. Follow the documentation to learn how to install these add-ons, configure the web server to record the response_time in the raw data, and make the response_time field available at search time. Find the Splunk Add-on for Apache Web Server and the Splunk Add-on for Microsoft IIS on Splunkbase.

Data check: Run the following search to verify you are searching for normalized web data that is ready for this use case:

earliest=-1day index=* tag=web
| head 10

Get insights

Use web server logs to gather web-page response times to identify whether application performance may cause a negative end-user experience.

Run the following search.

index=* tag=web
| stats avg(response_time) AS art BY uri_path

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

See the following video for more details related to this use case.
identify slow web pages

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.

Application developers can use web server access logs to summarize the response times of each page and identify the worst performing pages so that development teams can improve application performance.

Load data

How to implement: This example use case depends on data from web server logs.

Install the Splunk Add-on for Apache Web Server or the Splunk Add-on for Microsoft IIS. Follow the documentation to learn how to install these add-ons, configure the web server to record the response_time in the raw data, and make the response_time field available at search time. Find the Splunk Add-on for Apache Web Server and the Splunk Add-on for Microsoft IIS on Splunkbase.

Data check: Run the following search to verify you are searching for normalized web data that is ready for this use case:

earliest=-1day index=* tag=web
| head 10

Get insights

Use web server logs to gather web-page response times to identify whether application performance may cause a negative end-user experience.

Run the following search.

index=* tag=web
| stats avg(response_time) AS art BY uri_path

Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.

Help

See the following video for more details related to this use case.
identify slow web pages

If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.

For more support, post a question to the Splunk Answers community.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...