topic Re: Percentile 25 and Percentile 75 provides different result while using streamstats and stats in Splunk Search

Percentile 25 and Percentile 75 provides different result while using streamstats and stats

Kirantcs — Thu, 24 Sep 2020 18:57:37 GMT

Hello,

I have 3 values 15,26,18. Now assume my 18 is my latest value and i want to find p25 and p75 including the latest value by using all 3 values. If done i should one statistics with 2 column.

I tried to it by using stats and below is a picture.

Now i verified the same via internet and found the values as below.

Now i dont understaad why dont i get the same value while using streamstats, I use window=3 which shud consider all 3 value and since its streaming, shouldn't it just look at previous 3 values(current=t) and find p25 and p75?

Then why am i getting different values as below? Just look at the last row values.

Re: Percentile 25 and Percentile 75 provides different result while using streamstats and stats

richgalloway — Thu, 24 Sep 2020 19:11:40 GMT

I get the expected results when I use streamstats without the window option.

Re: Percentile 25 and Percentile 75 provides different result while using streamstats and stats

Kirantcs — Thu, 24 Sep 2020 19:20:07 GMT

Yes @richgalloway , care to explain how?

Re: Percentile 25 and Percentile 75 provides different result while using streamstats and stats

richgalloway — Thu, 24 Sep 2020 20:04:18 GMT

I can't explain it other that to say I tested several window values and only zero produced the expected results. It's definitely non-intuitive.