topic Re: Does perc95 require all the raw data for the entire interval? in Splunk Search

Does perc95 require all the raw data for the entire interval?

ddrillic — Sun, 16 Jun 2019 22:50:45 GMT

Perc95 is becoming more and more popular with our executives. We wonder whether we need to have all the raw data in order to calculate it.
So, let's say we know what it is for January and next we need to know the value for January and February.
Do we need all the raw data for January and February? or we can somehow capture whatever is needed from January in a summary index and calculate based on that and the raw data for February the value for both months together.

For clarity about the perc95's definition - what does perc95 and all those stats functions perc*

Re: Does perc95 require all the raw data for the entire interval?

DavidHourani — Mon, 17 Jun 2019 08:56:24 GMT

Hi @ddrillic,

The percX is based on the distribution of your results based on how many times each value appeared. If you save percXfrom January in a summary index for example you won't be able to use it to build the percX over January-February unless you knew the total number of count per value for January.

That being said, if you want to use summary indexing to improve performance for perc90 then you will need to save the count per value per month. With that you can take the count per value for January, February, sum it up and then use the perc90 on it to get the exact results.

Let me know if that helps.

Cheers,
David

Re: Does perc95 require all the raw data for the entire interval?

ddrillic — Mon, 17 Jun 2019 15:19:58 GMT

Very interesting David.

Re: Does perc95 require all the raw data for the entire interval?

DavidHourani — Wed, 17 Jul 2019 17:58:50 GMT

Thanks for accepting ! Happy Splunking 😉