Search pages based on their response time

[subhadipc]

I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 such pages ordered by their count. I wrote the following search query, but did not get success. Please help.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | stats count as cnt by cs_uri_stem | sort cnt 10 -

[kristian_kolb]

You don't provide a sample of your logs, but from what you write, I assume that something like the following would do what you want;

sourcetype=your_sourcetype time_taken > 100000 | top cs_uri_stem

Hope this helps,

Kristian