Splunk Search

Average response time by URL like

New Member

Team,

I want to write a query to generate report to know average response time of certain kind of URLs only , e.g.

sourcetype=access_combined | stats avg(RESP_TIME) by URL where like(URL,"%/suresh%"), avg(RESP_TIME) by URL where like(URL,"%/amaresh%"), avg(RESP_TIME) by URL where like(URL,"%/ramesh%")

When I am writing a query like above it's not giving any result, kind help me for the same.
Please let me know, if need any other details for the same.

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

How 'bout this?

sourcetype=access_combined (shuresh OR amaresh OR ramesh)
| eval url_category = case(like(URL,"%/suresh%"),"suresh",like(URL,"%/amaresh%"),"amaresh",like(URL,"%/ramesh%"),"ramesh")
| search url_category=* | stats avg(RESP_TIME) by url_category

Note, I've made some assumptions about the URLs in the initial search for performance gains. Make sure those assumptions hold for your environment, if they don't then just drop the parenthesised ORs.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

How 'bout this?

sourcetype=access_combined (shuresh OR amaresh OR ramesh)
| eval url_category = case(like(URL,"%/suresh%"),"suresh",like(URL,"%/amaresh%"),"amaresh",like(URL,"%/ramesh%"),"ramesh")
| search url_category=* | stats avg(RESP_TIME) by url_category

Note, I've made some assumptions about the URLs in the initial search for performance gains. Make sure those assumptions hold for your environment, if they don't then just drop the parenthesised ORs.

View solution in original post

0 Karma

New Member

Thank you very much for your kind help !!!

0 Karma

SplunkTrust
SplunkTrust

There are probably better ways, but I'd do that as three separate searches.

sourcetype=access_combined where like(URL,"%/suresh%") | stats avg(RESP_TIME) as rt_suresh | append [search sourcetype=access_combined where like(URL,"%/amaresh%") | stats avg(RESP_TIME) as rt_amaresh] | append [search sourcetype=access_combined where like(URL,"%/ramesh%") | stats avg(RESP_TIME) as rt_ramesh] | table rt_suresh, rt_amaresh, rt_ramesh
---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Thanks for help but i find below one was better choice.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!