Average response time by URL like

[moohkhol]

Team,

I want to write a query to generate report to know average response time of certain kind of URLs only , e.g.

sourcetype=access_combined | stats avg(RESP_TIME) by URL where like(URL,"%/suresh%"), avg(RESP_TIME) by URL where like(URL,"%/amaresh%"), avg(RESP_TIME) by URL where like(URL,"%/ramesh%")

When I am writing a query like above it's not giving any result, kind help me for the same.
Please let me know, if need any other details for the same.

[martin_mueller · Accepted solution]

How 'bout this?

sourcetype=access_combined (shuresh OR amaresh OR ramesh)
| eval url_category = case(like(URL,"%/suresh%"),"suresh",like(URL,"%/amaresh%"),"amaresh",like(URL,"%/ramesh%"),"ramesh")
| search url_category=* | stats avg(RESP_TIME) by url_category

Note, I've made some assumptions about the URLs in the initial search for performance gains. Make sure those assumptions hold for your environment, if they don't then just drop the parenthesised ORs.

[moohkhol]

Thank you very much for your kind help !!!

[richgalloway]

There are probably better ways, but I'd do that as three separate searches.

sourcetype=access_combined where like(URL,"%/suresh%") | stats avg(RESP_TIME) as rt_suresh | append [search sourcetype=access_combined where like(URL,"%/amaresh%") | stats avg(RESP_TIME) as rt_amaresh] | append [search sourcetype=access_combined where like(URL,"%/ramesh%") | stats avg(RESP_TIME) as rt_ramesh] | table rt_suresh, rt_amaresh, rt_ramesh

[moohkhol]

Thanks for help but i find below one was better choice.