search query based on response time

[subhadipc]

I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 such pages ordered by their count. I wrote the following search query, but did not get success. Please help.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | stats count as cnt by cs_uri_stem | sort cnt 10 -

[subhadipc]

Another way is to write the following query:

| eval time_sec = round(time_taken/1000) | where time_sec > 100 | where time_sec > 100 | stats count by cs_uri_stem | sort - count | head xx

Using this, one may replace xx with the number, e.g. 10 as in the question

[BobM]

adding limit=10 to the sort command does the same as head but is more efficient as splunk doesn't have to sort all lines.

The top comand by default returns 10 but you can change it by adding limit=xx to any number you want.

[BobM]

The only thing I can see wrong (assuming the fields exist in your data) is the sort command.
Try

| sort - cnt limit=10

but it would probably be easier to use the top command.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | top cs_uri_stem showperc=f

Bob