topic Re: How do I set an alert when 95th percentile is over the threshold? in Splunk Search

How do I set an alert when 95th percentile is over the threshold?

mlui_2 — Tue, 19 Jun 2018 18:47:49 GMT

Hi all,

Here is my base search

index=java  location=APICall api_method=POST Duration |stats   median(Duration) as median, perc70(Duration) as p70, perc90(Duration) as p90, perc95(Duration) as p95, perc99(Duration) as p99

How do I set an alert when 95th percentile is over let's say 30000ms ?

Thanks in advance

Re: How do I set an alert when 95th percentile is over the threshold?

pjdwyer — Tue, 19 Jun 2018 21:00:16 GMT

If I understand your data correctly you would want to add a where statement before the stats statement.

| where perc95(duration) > 30000

and if you want to add more clauses to the statement you can do it this way:

| where (perc70(duration) > 30000) OR (perc90(duration) > 30000) OR (perc95(duration) > 30000) OR (perc99(duration) > 30000)

This statement will remove any information that does not meet the said criteria.

Re: How do I set an alert when 95th percentile is over the threshold?

mlui_2 — Tue, 19 Jun 2018 21:04:35 GMT

got it

timechart span=5m perc95(Duration) as P95 | where P95>30000ms

Re: How do I set an alert when 95th percentile is over the threshold?

mlui_2 — Tue, 19 Jun 2018 21:16:04 GMT

index=java location=APICall api_method=POST Duration |timechart span=5m perc95(Duration) as P95| where P95> 30000ms