how to get response time for first page and second page of web survey from iis logs in splunk

[Laya123]

Hi,

Any one can help me to get response time for first page and second page of web survey from iis logs in splunk

example if X user doing one web survey which is having more than 2 pages of survey.

I want to calculate average response time to open first page and after clicking of next how much time its has taken to open second page

Pl help me

Regards

[Runals]

You'd have to doublecheck the command options but I would maybe look at the transaction command which will output a new field called duration

... | transation clientip startswith=<page1> endswith=<page2> 

Depending on data volume and Splunk version transaction may run slower than doing other commands (at least it feels like it runs faster in 6.2.2 from our last version 6.1.3 or maybe just our first version 5.0 - I know I'm not growing any more patient as I age 😃

At any rate you could get the same effect with stats and maybe more speed. One thing you lose in stats vs transaction though is in transaction to can set the max time for each event which may or may not be a big deal but could help account for reuse of an IP during the course of a day or whatever timeframe you are searching across (think user at some McDonalds wifi).

sourcetype = iis uri=<page1> OR uri=<page2>  | stats max(_time) as second_page min(_time) as first_page by clientip | eval delta = second_page - first_page

One thing to remember is Splunk searches in reverse chronological order and time is stored in numeric format (epoch) which is why max (or using first() ) is the second page and min (or using last() ) is the first page. If there are spaces or major delimiters before and behind the uri page deal you could probably make this faster still by dropping the fields and using TERM()

sourcetype=iis TERM(<page1>) OR TERM(<page2>) | stats max(_time) as second_page min(_time) as first_page by clientip | eval delta = second_page - first_page

[rsennett_splunk]

It sounds like you want to begin a kind of funnel and qualify whether someone has followed a particular path and then grab the response time fields an make your comparison... so you might want to check this out for a way to get started:
http://blogs.splunk.com/2014/01/23/quick-n-dirty-funnels/

[Laya123]

Thank you so much

[rakesh_498115]

Hi Laya123,

Can you post sample log here. basically your interested in knowing the time difference b/w the page1 and page2 right ?

Rocky

[Laya123]

yes, i want time difference between page 1 and page 2 and how much time taken for opening first page also