Splunk Search

search query based on response time

subhadipc
Explorer

I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 such pages ordered by their count. I wrote the following search query, but did not get success. Please help.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | stats count as cnt by cs_uri_stem | sort cnt 10 -

Tags (1)
0 Karma

subhadipc
Explorer

Another way is to write the following query:

| eval time_sec = round(time_taken/1000) | where time_sec > 100 | where time_sec > 100 | stats count by cs_uri_stem | sort - count | head xx

Using this, one may replace xx with the number, e.g. 10 as in the question

0 Karma

BobM
Builder

adding limit=10 to the sort command does the same as head but is more efficient as splunk doesn't have to sort all lines.

The top comand by default returns 10 but you can change it by adding limit=xx to any number you want.

0 Karma

BobM
Builder

The only thing I can see wrong (assuming the fields exist in your data) is the sort command.
Try

| sort - cnt limit=10

but it would probably be easier to use the top command.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | top cs_uri_stem showperc=f

Bob

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...