Step 4: Popular and slow endpoints

Two different questions: which pages are popular (most hits) and which are slow (high response time)? Use Counter.most_common for the first, and group the times per path for the second. Averages hide outliers, so also report the median and the 95th percentile (the time that 95% of requests beat): tail latency is what unhappy users feel.

Examplepython

import re
from collections import Counter, defaultdict

LOG = """2026-11-05 09:00:01 10.0.0.5 GET /home 200 120
2026-11-05 09:00:03 10.0.0.9 GET /login 200 80
2026-11-05 09:00:07 10.0.0.9 POST /login 401 95
2026-11-05 09:00:09 10.0.0.9 POST /login 401 91
2026-11-05 09:00:12 10.0.0.9 POST /login 401 99
2026-11-05 09:00:15 10.0.0.9 POST /login 401 97
2026-11-05 09:01:02 10.0.0.5 GET /courses 200 340
2026-11-05 09:01:20 10.0.0.7 GET /courses/python 200 410
2026-11-05 09:01:44 10.0.0.7 GET /missing 404 30
2026-11-05 09:02:05 10.0.0.5 GET /api/progress 500 1200
2026-11-05 09:02:09 10.0.0.5 GET /api/progress 500 1180
2026-11-05 09:02:30 10.0.0.8 GET /home 200 110
2026-11-05 09:03:10 10.0.0.8 GET /courses 200 360
2026-11-05 09:03:12 10.0.0.7 GET /home 200 105
2026-11-05 09:03:50 10.0.0.6 GET /api/progress 200 220
this line is not a valid log entry
2026-11-05 09:04:01 10.0.0.6 GET /home 200 98
2026-11-05 09:04:33 10.0.0.7 GET /courses/sql 200 395
2026-11-05 09:05:02 10.0.0.8 GET /missing 404 28"""

PATTERN = re.compile(
    r"^(?P<date>\d{4}-\d{2}-\d{2}) (?P<time>\d{2}:\d{2}:\d{2}) "
    r"(?P<ip>\S+) (?P<method>[A-Z]+) (?P<path>\S+) (?P<status>\d{3}) (?P<ms>\d+)$"
)

def parse(text):
    entries = []
    for line in text.splitlines():
        m = PATTERN.match(line)
        if m:
            e = m.groupdict()
            e["status"], e["ms"] = int(e["status"]), int(e["ms"])
            entries.append(e)
    return entries

entries = parse(LOG)

hits = Counter(e["path"] for e in entries)
print("top paths:", hits.most_common(3))

times = defaultdict(list)
for e in entries:
    times[e["path"]].append(e["ms"])

print(f"{'path':<18}{'hits':>5}{'avg ms':>9}{'max ms':>8}")
for path, values in sorted(times.items(), key=lambda kv: -sum(kv[1]) / len(kv[1])):
    print(f"{path:<18}{len(values):>5}{sum(values) / len(values):>9.0f}{max(values):>8}")

def percentile(values, p):
    ordered = sorted(values)
    index = round((p / 100) * (len(ordered) - 1))
    return ordered[index]

all_ms = [e["ms"] for e in entries]
print("median:", percentile(all_ms, 50), "p95:", percentile(all_ms, 95))

Open in editor »

/api/progress averages about 870 ms because of its two 1.2-second failures, far above the home page. Sorting by slowest first puts the worst offenders at the top of the report, where people will read them.

Your turn: write the code

Write average(values) that returns the mean rounded to 1 decimal, or None for an empty list. Print average([100, 200, 450]) and average([]).

Quick check

Why report a percentile as well as the average?

Averages hide slow outliers that users feelPercentiles are easier to computeThe average is always wrong

Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.

Tip: use the left and right arrow keys to move between lessons.