Monitoring Splunk

Timewise Distribution of Response Times of cs_uri_stem

subhadipc
Explorer

Hi,

I have the following query:

... | eval time_sec = round(time_taken/1000) | chart max(time_sec) as

max_response_time, min(time_sec) as min_response_time, avg(time_sec) as

avg_response_time by cs_uri_stem

This gives me avg. response time per page over a period of 7 days. One can

see that there is a big difference between the min, and max response time. I

want to see the distribution of response times of each of the pages at various

times of the day. The grouping may be done in 2 hours gaps.

eg.,
cs_uri_stem date/time min max avg
x.aspx 27/02..2:00 1 5 3
y.aspx 27/02..4:00 1 4 3
:
:

0 Karma

_d_
Splunk Employee
Splunk Employee

Try this:

.. | eval time_sec = round(time_taken/1000) | timechart span=2h max(time_sec) AS max_response_time, min(time_sec) AS min_response_time, avg(time_sec) AS avg_response_time by cs_uri_stem

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...