Splunk Search

search query based on response time

subhadipc
Explorer

I need to know the pages, along with the count of how many times their response time exceeded 100. I need the top 10 such pages ordered by their count. I wrote the following search query, but did not get success. Please help.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | stats count as cnt by cs_uri_stem | sort cnt 10 -

Tags (1)
0 Karma

subhadipc
Explorer

Another way is to write the following query:

| eval time_sec = round(time_taken/1000) | where time_sec > 100 | where time_sec > 100 | stats count by cs_uri_stem | sort - count | head xx

Using this, one may replace xx with the number, e.g. 10 as in the question

0 Karma

BobM
Builder

adding limit=10 to the sort command does the same as head but is more efficient as splunk doesn't have to sort all lines.

The top comand by default returns 10 but you can change it by adding limit=xx to any number you want.

0 Karma

BobM
Builder

The only thing I can see wrong (assuming the fields exist in your data) is the sort command.
Try

| sort - cnt limit=10

but it would probably be easier to use the top command.

...| eval time_sec = round(time_taken/1000) | where time_sec > 100 | top cs_uri_stem showperc=f

Bob

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...