topic Re: Percentile from histogram data in Splunk Dev

Percentile from histogram data

yashveer_arya — Thu, 15 Mar 2018 04:59:06 GMT

Hi,
I am pushing latency histogram data to spulk. i.e

Number of
times latency
under time range : Time range (sec)
5 : 1
2 : 2
1 : 3

above histogram is created and dumped by client from individual entries of latency -> Latency under 1 Sec (5 times), 2 sec (2 times), 3 sec (1 time) : 1,1,1,1,1,2,2,3
If i have these individual records in a field at splunk then it is easy to find out the per99() by just applying this function on that field. But i do not have individual records and have buckets as mentioned above.

What is the best way to calculate the percentile to give the same result as it should give by applying per99() on individual entries (e.g. 1,1,1,1,1,2,2,3) ?

thanks

Re: Percentile from histogram data

p_gurav — Thu, 15 Mar 2018 11:00:51 GMT

Can you try something like this with your data:

| makeresults | eval ph="0,0,0,0,0,0,0,1,0,34,66,66,64,68,60,79,7374,13812,0,0,0,0,0,0,0,0,0,0" | eval times="0,1,2,3,4,5,6,7,8,9,10,20,30,40,50,60,70,80,90,100,200,300,400,500,600,700,800,900" | makemv ph delim="," | makemv times delim="," | eval z=mvzip(times, ph) | mvexpand z | rex field=z "(?<t>[^\,]+)\,(?<ph>.*)" | table _time t ph | chart values(ph) as ph over t by _time

Re: Percentile from histogram data

yashveer_arya — Thu, 15 Mar 2018 19:29:37 GMT

Thanks
but i do not have common seperated list of numbers bu i have histogram i want to get this comma seperated list on the basis of count.
E.g. I have
5 : 1 (1, 5 times)
2 : 2 (2, 2 times)
1 : 3 (3, 1 times)

and want 1,1,1,1,2,2,3

Re: Percentile from histogram data

p_gurav — Fri, 16 Mar 2018 05:53:33 GMT

Try this: