Getting Data In

how to get response time for first page and second page of web survey from iis logs in splunk

Laya123
Communicator

Hi,

Any one can help me to get response time for first page and second page of web survey from iis logs in splunk

example if X user doing one web survey which is having more than 2 pages of survey.

I want to calculate average response time to open first page and after clicking of next how much time its has taken to open second page

Pl help me

Regards

Tags (1)
0 Karma

Runals
Motivator

You'd have to doublecheck the command options but I would maybe look at the transaction command which will output a new field called duration

... | transation clientip startswith=<page1> endswith=<page2> 

Depending on data volume and Splunk version transaction may run slower than doing other commands (at least it feels like it runs faster in 6.2.2 from our last version 6.1.3 or maybe just our first version 5.0 - I know I'm not growing any more patient as I age 😃

At any rate you could get the same effect with stats and maybe more speed. One thing you lose in stats vs transaction though is in transaction to can set the max time for each event which may or may not be a big deal but could help account for reuse of an IP during the course of a day or whatever timeframe you are searching across (think user at some McDonalds wifi).

sourcetype = iis uri=<page1> OR uri=<page2>  | stats max(_time) as second_page min(_time) as first_page by clientip | eval delta = second_page - first_page

One thing to remember is Splunk searches in reverse chronological order and time is stored in numeric format (epoch) which is why max (or using first() ) is the second page and min (or using last() ) is the first page. If there are spaces or major delimiters before and behind the uri page deal you could probably make this faster still by dropping the fields and using TERM()

sourcetype=iis TERM(<page1>) OR TERM(<page2>) | stats max(_time) as second_page min(_time) as first_page by clientip | eval delta = second_page - first_page

rsennett_splunk
Splunk Employee
Splunk Employee

It sounds like you want to begin a kind of funnel and qualify whether someone has followed a particular path and then grab the response time fields an make your comparison... so you might want to check this out for a way to get started:
http://blogs.splunk.com/2014/01/23/quick-n-dirty-funnels/

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

Laya123
Communicator

Thank you so much

0 Karma

rakesh_498115
Motivator

Hi Laya123,

Can you post sample log here. basically your interested in knowing the time difference b/w the page1 and page2 right ?

Rocky

0 Karma

Laya123
Communicator

yes, i want time difference between page 1 and page 2 and how much time taken for opening first page also

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...