index=web_logs sourcetype=access_combined | eval request_duration=round(duration/1000, 2) | stats avg(request_duration) as avg_duration by host, uri_path | where avg_duration > 2 | sort - avg_duration
What help do you need? Please explain what your issue is, and what your desired results would look like.
