topic Re: Mark 90% trend in data? in Dashboards & Visualizations

Mark 90% trend in data?

feickertmd — Mon, 13 Feb 2017 15:12:48 GMT

A requirement I have is to show API response times over time, marking min, max, avg and 90% range. In other words, be able to say "90% of response time are X milliseconds or lower.

Not sure how to approach it. Advice appreciated.

Re: Mark 90% trend in data?

jkat54 — Mon, 13 Feb 2017 15:19:20 GMT

Please see the percX(Y) function of the stats command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

... | stats perc90(responseTimeField)

Re: Mark 90% trend in data?

DalJeanis — Mon, 13 Feb 2017 15:29:42 GMT

In the search reference, it's listed in the statistical/aggregate functions, and it's called percxx(), where xx in this case would be 90. If you wanted the 90th percentile of the response variable, then it would something look like

| stats min(response) as minresp, max() as maxresp, avg(response) as avgresp, perc90(response) as p90resp by ((whatever))

You should probably read the notes, since there are some interesting things about the function. It actually produces a close estimate that is cheaper and faster to calculate, but you can use exactperc90() to calculate the exact one if you really needed it.

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

Re: Mark 90% trend in data?

feickertmd — Mon, 13 Feb 2017 15:42:19 GMT

I don't think I am looking for percentile. I am looking for frequency.
Take, for instance, this list of 30 values:
0 0 1 1 2 2 2 3 3 4 4 4 5 5 5 5 6 6 6 7 7 7 7 8 8 8 9 9 9 9

In this case, the 90th percentile is 9, but 90% of the values are <=7.

Looking for the second figure.

Re: Mark 90% trend in data?

feickertmd — Mon, 13 Feb 2017 15:42:43 GMT

and I am not a stats guy, so I may not be seeing things right!

Re: Mark 90% trend in data?

somesoni2 — Mon, 13 Feb 2017 16:09:09 GMT

Your original requirement says "90% of response time are X milliseconds or lower.", so perc90 is the metrics that you need which say 90% of the entries are 9 or lower (per your example).

Re: Mark 90% trend in data?

feickertmd — Mon, 13 Feb 2017 16:37:51 GMT

Thanks. I have played with my sample data a bit more, and I see it better. Like I said, not a stats guy, so I wasn't surprised to find I misunderstood.

Re: Mark 90% trend in data?

jkat54 — Mon, 13 Feb 2017 16:41:45 GMT

🙂 we grade on a curve here.. you're fine!