index=web_logs sourcetype=access_combined
| eval request_duration=round(duration/1000, 2)
| stats avg(request_duration) as avg_duration by host, uri_path
| where avg_duration > 2
| sort - avg_duration
What help do you need? Please explain what your issue is, and what your desired results would look like.