Displaying web page response time by action

We can further amend the search to offer granular information on average response times by the type of action being performed. This might pinpoint some actions that are less responsive than other actions. For example, we might want to ensure that the checkout page remains at an optimal load time. For the following search to work, you must complete the Defining field extractions recipe in Chapter 1, Play Time – Getting Data In, to extract the response field:

sourcetype=access_combined uri_path=* | timechart span=6h avg(response) by uri_path | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1000,2)]

We are now searching for web page events, and then we will calculate the average time by page (uri_field). This results in a table of multiple columns, where each column represents a different web page. When we visualize this on a line graph, we now see many different lines on the same chart-pretty cool! You will notice that we used a pretty advanced Splunk search command, earlier named foreach. This is essentially a for type loop that cycles through each of the column fields in the table and applies a calculation to convert the average time by page from milliseconds to seconds while rounding the value to two decimal places. The following screenshot illustrates the graph: