https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46588#M11125 <P>I am not getting the desired result when i use perc..can you pls give me the query to calulcate the top 95 durations average and last 5 durations .</P> Wed, 29 Aug 2012 12:02:30 GMT rakesh_498115 2012-08-29T12:02:30Z https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46586#M11123 <P>Hi,</P> <P>I have written a query which gives me the list of durations of all the transactions.Now i need to calucalte the avg of top95 durations and avg of the last 5 durations . how do i do that in single query.</P> <P>my query to list durations is.</P> <P>sourcetype="data" "request OR response" | keepevicted=true transaction prod_id | top limit=100 duration </P> <P>displays only the top 100 durations values . but i need the stats for avg of top 95 duration values and avg of last 5 duration values..</P> <P>Please help..</P> <P>thanx</P> Wed, 29 Aug 2012 11:04:18 GMT https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46586#M11123 rakesh_498115 2012-08-29T11:04:18Z https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46587#M11124 <P>hi rakesh_498115</P> <P>you can use the p<X>() function of chart, stats and timechart for example</X></P> <PRE><CODE>p&lt;X&gt;(Y) | perc&lt;X&gt;(Y) This function returns the X-th percentile value of the field Y. This example returns the 5th percentile value of a field "total":perc5(total) </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/CommonStatsFunctions</A></P> <P>cheers,<BR /> MuS</P> Wed, 29 Aug 2012 11:50:38 GMT https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46587#M11124 MuS 2012-08-29T11:50:38Z https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46588#M11125 <P>I am not getting the desired result when i use perc..can you pls give me the query to calulcate the top 95 durations average and last 5 durations .</P> Wed, 29 Aug 2012 12:02:30 GMT https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46588#M11125 rakesh_498115 2012-08-29T12:02:30Z https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46589#M11126 <P>| eventstats p95(duration) AS dur_limit | where duration &lt; dur_limit | stats avg(duration)</P> <P>should do just fine</P> Mon, 28 Sep 2020 12:21:09 GMT https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46589#M11126 MuS 2020-09-28T12:21:09Z https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46590#M11127 <P>How do i get both the stats in single query ... ??</P> Wed, 29 Aug 2012 19:38:25 GMT https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46590#M11127 rakesh_498115 2012-08-29T19:38:25Z https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46591#M11128 <P>It's also worth noticing that pX() is using APPROXIMATION not exact value when you have &gt;1000 data points, see <A href="http://splunk-base.splunk.com/answers/44336/percentile-implementation">http://splunk-base.splunk.com/answers/44336/percentile-implementation</A></P> Thu, 30 Aug 2012 04:49:33 GMT https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46591#M11128 kallu 2012-08-30T04:49:33Z https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46592#M11129 <P>you can combine any searches with append <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append" target="_blank">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append</A> and here is the string you need:</P> <P>your search<BR /> | eventstats p5(duration) AS low_limit <BR /> | where duration &gt; low_limit <BR /> | stats avg(duration) AS dur_low_avg <BR /> | append [<BR /> | eventstats p95(duration) AS max_limit <BR /> | where duration &lt; max_limit <BR /> | stats avg(duration) AS dur_max_avg]</P> <P>this will run for awhile depending on your amount of data, because it runs each search on it own and not at the same time. so thanks for your upvote and kudos <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>cheers,<BR /> MuS</P> Mon, 28 Sep 2020 12:21:20 GMT https://community.splunk.com/t5/Splunk-Search/can-i-know-the-best95-and-worst5-stats-in-splunk/m-p/46592#M11129 MuS 2020-09-28T12:21:20Z