https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71343#M996 <P>How to check 95th percentile of a particular message (Ex: Message ok) which is coming 20 times.</P> <P>Ex<BR /> 03/22/2013 03:38:56.752 Message ok</P> <P>which is coming 20 times.</P> <P>Please tell me the same.</P> Fri, 22 Mar 2013 10:25:54 GMT chaitu99 2013-03-22T10:25:54Z https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71343#M996 <P>How to check 95th percentile of a particular message (Ex: Message ok) which is coming 20 times.</P> <P>Ex<BR /> 03/22/2013 03:38:56.752 Message ok</P> <P>which is coming 20 times.</P> <P>Please tell me the same.</P> Fri, 22 Mar 2013 10:25:54 GMT https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71343#M996 chaitu99 2013-03-22T10:25:54Z https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71344#M997 <P>Have you checked the <CODE>percX()</CODE> function for <CODE>stats</CODE>?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Stats">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Stats</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions</A></P> <PRE><CODE>your search | stats perc95(your_field) | the rest of your search </CODE></PRE> <P>/k</P> Fri, 22 Mar 2013 11:09:49 GMT https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71344#M997 kristian_kolb 2013-03-22T11:09:49Z https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71345#M998 <P>You can use the perc()x(field) function. More information: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions</A></P> <P>Example:<BR /> Let's say that your field OK="Message ok". Then, you could use the perc(x)(field) function as follow:</P> <PRE><CODE>earliest=-1d@d latest=@d index=main sourcetype=messages|stats perc95(ok) earliest=-7d@d latest=@d index=main sourcetype=messages|timechart span=d perc95(ok) </CODE></PRE> Fri, 22 Mar 2013 11:12:03 GMT https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71345#M998 lpolo 2013-03-22T11:12:03Z https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71346#M999 <P>Hello <BR /> My requiremet is if "message ok" will come in log file then that is successful.</P> <P>i am running it 20 times, so 20 times "message ok" will come in log.<BR /> i have to check the 95th percentile of success rate.</P> Fri, 22 Mar 2013 12:07:53 GMT https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71346#M999 chaitu99 2013-03-22T12:07:53Z https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71347#M1000 <P>Hello <BR /> My requiremet is if "message ok" will come in log file then that is successful.</P> <P>i am running it 20 times, so 20 times "message ok" will come in log.<BR /> i have to check the 95th percentile of success rate.</P> Fri, 22 Mar 2013 12:08:23 GMT https://community.splunk.com/t5/Splunk-Dev/95-percentile/m-p/71347#M1000 chaitu99 2013-03-22T12:08:23Z