Skip to main content
Lantern Home
 
 
Splunk Lantern

Top ten slowest web pages on a web server

  1. Last updated
  2. Save as PDF

 

Slow page response times lead to several major problems such as user dissatisfaction, SLA violations, and unnecessary resource utilization. When users are browsing a site, page load times above 500ms are noticeably slow. You want to identify the worst performing resources for your site so you can investigate the causes.

Data required

Web server data

Procedure

  1. Ensure you have deployed a web server add-on to the search heads so that web server data tags and fields are defined. This sample search uses the Splunk Add-on for Apache Web Server, but you can replace this source with any other web server data used in your organization. For more information, see About installing Splunk add-ons.
  2. If you’re using the Splunk Add-on for Apache Web Server, make sure to configure log formatting on the Apache Web Server. This step makes sure you have all the required fields present in apache_access.log and especially the response time value needed for this procedure. For detailed configuration steps, see Configure log formatting on the Apache Web Server using httpd.conf.
  3. Run the following search. You can optimize it by specifying an index and adjusting the time range.
tag=web response_time=*
|stats avg(response_time) AS avg_duration perc95(response_time) AS perc95_duration max(response_time) AS max_response_time BY uri_path
|sort - perc_95_duration
|head 10

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

tag=web response_time=*

Search for events that are tagged as web events with any response time.

|stats avg(response_time) AS avg_duration perc95(response_time) AS perc95_duration max(response_time) AS max_response_time BY uri_path

Return the average, 95th percentile, and maximum response times for each uri_path, and display the results using the column names shown.

You can replace uri_path with another field, such as uri_stem, for a directory, or url, which provides the time taken to perform specific actions such as /cart/checkout, which is relevant to an e-commerce site.

|sort - perc_95_duration

Sort the results with the worst performing response times first.

|head 10

Filter to the top 10 worst performing pages.

Next steps

The next step is to investigate the cause of the slowness by investigating the infrastructure involved in producing the resource pointed to by the path. It could be slow server side code, too little compute resources, or inadequate storage infrastructure.

Finally, you might be interested in other processes associated with the Managing web server performance use case.