Monitoring Splunk

Timewise Distribution of Response Times of cs_uri_stem

subhadipc
Explorer

Hi,

I have the following query:

... | eval time_sec = round(time_taken/1000) | chart max(time_sec) as

max_response_time, min(time_sec) as min_response_time, avg(time_sec) as

avg_response_time by cs_uri_stem

This gives me avg. response time per page over a period of 7 days. One can

see that there is a big difference between the min, and max response time. I

want to see the distribution of response times of each of the pages at various

times of the day. The grouping may be done in 2 hours gaps.

eg.,
cs_uri_stem date/time min max avg
x.aspx 27/02..2:00 1 5 3
y.aspx 27/02..4:00 1 4 3
:
:

0 Karma

_d_
Splunk Employee
Splunk Employee

Try this:

.. | eval time_sec = round(time_taken/1000) | timechart span=2h max(time_sec) AS max_response_time, min(time_sec) AS min_response_time, avg(time_sec) AS avg_response_time by cs_uri_stem

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...