Skip to main content


Splunk Lantern

Top ten slowest web pages on a web server

You might need to identify the slowest web pages on your web server when doing the following:


In order to execute this procedure in your environment, the following data, services, or apps are required:


Slow page response times lead to several major problems such as user dissatisfaction, SLA violations, and unnecessary resource utilization. When users are browsing a site, page load times above 500ms are noticeably slow. You want to identify the worst performing resources for your site so you can investigate the causes.

To optimize the search shown below, you should specify an index and a time range. In addition, this sample search uses Splunk Add-on for Apache Web Server. You can replace this source with any other web server data used in your organization. 

  1. Verify you deployed a web server add-on to the search heads, so that the needed tags and fields are defined. For more information, see About installing Splunk add-ons.
  2. If you’re using The Splunk Add-on for Apache Web Server, make sure to configure log formatting on the Apache Web Server as described in the following link. This step will make sure you have all the required fields present in apache_access.log and especially the response time value needed for this procedure. For detailed configuration steps, see Configure log formatting on the Apache Web Server using httpd.conf.
  3. Run the following search: 
|stats avg(response_time) AS avg_duration perc95(response_time) AS perc95_duration max(response_time) AS max_response_time BY uri_path
|sort - perc_95_duration
|head 10

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation


Search for events that are tagged as web events.

|stats avg(response_time) AS avg_duration perc95(response_time) AS perc95_duration max(response_time) AS max_response_time BY uri_path

Return the average, 95th percentile, and maximum response times for each uri_path, and display the results using the column names shown.


You can replace uri_path with another field, such as uri_stem, for a directory, or url, which provides the time taken to perform specific actions such as /cart/checkout, which is relevant to an e-commerce site.

|sort - perc_95_duration

Sort the results with the worst performing response times first.

|head 10

Filter to the top 10 worst performing pages.


The next step is to investigate the cause of the slowness by investigating the infrastructure involved in producing the resource pointed to by the path. It could be slow server side code, too little compute resources, or inadequate storage infrastructure. 

  • Was this article helpful?