topic Re: p90 in splunk in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623908#M107329 <P>I don't know exactly how Splunk computes the perc90 number other than using the "Nearest Rank" algorithm, but the docs at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Aggregatefunctions#perc.26lt.3BX.26gt.3B.28Y.29" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Aggregatefunctions#perc.26lt.3BX.26gt.3B.28Y.29</A>&nbsp;call it an estimate.&nbsp; You can try the <FONT face="courier new,courier">exactperc90</FONT> function to see if it gives a better result.</P> Sat, 10 Dec 2022 19:12:40 GMT richgalloway 2022-12-10T19:12:40Z How to get the percentile 90 of the response time in Splunk? https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623823#M107316 <P>Hi Team</P> <P>&nbsp;I want to get the percentile 90 of the response time in splunk. Suppose I have the below response times. What is the query with which I can get the percentile 90 in Splunk</P> <P>&nbsp;</P> <P>1.379<BR />1.276<BR />1.351<BR />2.062<BR />1.465<BR />3.107<BR />1.621<BR />1.901<BR />1.562<BR />27.203</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Please help on the same</P> Mon, 12 Dec 2022 16:14:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623823#M107316 Subarna 2022-12-12T16:14:03Z Re: p90 in splunk https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623843#M107319 <P>Assuming the response times are stored in a field called 'response_time' that you could calculate that statistic using the <FONT face="courier new,courier">p90</FONT> function in the <FONT face="courier new,courier">stats</FONT> command.</P><LI-CODE lang="markup">... | stats p90(response_time) as p90_response_time</LI-CODE><P>&nbsp;</P> Fri, 09 Dec 2022 14:53:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623843#M107319 richgalloway 2022-12-09T14:53:01Z Re: p90 in splunk https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623886#M107328 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;</P><P>Below are the response times. As per my understanding the 90th Percentile of the Response times should be 3.10 . But if I use the command u mentioned below it is coming as 5.51. Please help me to understand the calculation that is done to find out the 90th percentile.</P><P><SPAN>1.379</SPAN><BR /><SPAN>1.276</SPAN><BR /><SPAN>1.351</SPAN><BR /><SPAN>2.062</SPAN><BR /><SPAN>1.465</SPAN><BR /><SPAN>3.107</SPAN><BR /><SPAN>1.621</SPAN><BR /><SPAN>1.901</SPAN><BR /><SPAN>1.562</SPAN><BR /><SPAN>27.203</SPAN></P> Sat, 10 Dec 2022 02:57:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623886#M107328 Subarna 2022-12-10T02:57:17Z Re: p90 in splunk https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623908#M107329 <P>I don't know exactly how Splunk computes the perc90 number other than using the "Nearest Rank" algorithm, but the docs at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Aggregatefunctions#perc.26lt.3BX.26gt.3B.28Y.29" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Aggregatefunctions#perc.26lt.3BX.26gt.3B.28Y.29</A>&nbsp;call it an estimate.&nbsp; You can try the <FONT face="courier new,courier">exactperc90</FONT> function to see if it gives a better result.</P> Sat, 10 Dec 2022 19:12:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623908#M107329 richgalloway 2022-12-10T19:12:40Z Re: p90 in splunk https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623938#M107332 <P>An interesting point - as&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;points out, it uses nearest rank method for perc(), but you will note a difference if you use exacperc90(x), which will return you 27.203</P><P>Looking at the interpolated method on that Wikiepedia page, you can see that</P><P>PC: percentile specified 0.10 0.25 0.50 0.75 0.90</P><TABLE><TBODY><TR><TD>N: number of scores</TD><TD>10</TD><TD>10</TD><TD>10</TD><TD>10</TD><TD>10</TD></TR><TR><TD>OR: PC×(N+1) / PC×(N−1)+1</TD><TD>1.1/1.9</TD><TD>2.75/3.25</TD><TD>5.5/5.5</TD><TD>8.25/7.75</TD><TD>9.9/9.1</TD></TR><TR><TD>LoRank: OR truncated</TD><TD>1/1</TD><TD>2/3</TD><TD>5/5</TD><TD>8/7</TD><TD>9/9</TD></TR><TR><TD>HIRank: OR rounded up</TD><TD>2/2</TD><TD>3/4</TD><TD>6/6</TD><TD>9/8</TD><TD>10/10</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>The HiRank gives you the 10/10 position for a 90th percentile, which in your example, seems rather counter-intuitive.</P><P>&nbsp;</P> Sun, 11 Dec 2022 23:22:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-percentile-90-of-the-response-time-in-Splunk/m-p/623938#M107332 bowesmana 2022-12-11T23:22:08Z