topic Re: 90th percentile in Splunk Search

90th percentile

rj1408 — Wed, 23 Dec 2020 11:06:54 GMT

Hi I need to find 90th percentage avg, I tried by this way

base search| mainMethod=LostStolen OR mainMethod=CreditLimit OR mainMethod=LoanCreation| stats max(ResponseTime) avg(ResponseTime) as count by mainMethod| eventstats perc90(avg)

I'm getting like this

mainMethod Max avg(ResponseTime) Avg(90p)
LostStolen 2000 1900 1834
CreditLimit 1800 1734 1834
LoanCreation 1925 1867 1834

The avg 90p is replicating from the first and if I add in eventstats as count by clause it throws error

Re: 90th percentile

to4kawa — Tue, 29 Dec 2020 02:35:17 GMT

| makeresults | eval _raw="mainMethod Max avg_ResponseTime LostStolen 2000 1900 CreditLimit 1800 1734 LoanCreation 1925 1867" | multikv forceheader=1 | rename "avg_ResponseTime" as "avg(ResponseTime)" | table mainMethod Max avg* | rename COMMENT as "this is your table sample, check this. from here, the logic" | eventstats perc90(eval(round('avg(ResponseTime)',1))) as "Avg(90p)"

Re: 90th percentile

rj1408 — Mon, 18 Jan 2021 11:48:57 GMT

Hi Its still same issue, it is replecting from the first row, and it copies until the last row!

Re: 90th percentile

scelikok — Mon, 18 Jan 2021 16:32:55 GMT

Hi @rj1408,

Please try this;

| stats max(ResponseTime) as Max avg(ResponseTime) as Avg perc90(ResponseTime) as Avg90p by mainMethod

If this reply helps you an upvote is appreciated.

Re: 90th percentile

rj1408 — Tue, 19 Jan 2021 06:11:10 GMT

Hi,
with perc90(responseTime), I'm unable to get avg of the response time with only top 90 response time out of 100 which is 90th percentile avg response time.

Re: 90th percentile

scelikok — Tue, 19 Jan 2021 07:36:36 GMT

Hi @rj1408,

I misunderstood your request, please try below;

| eventstats avg(ResponseTime) as Avg by mainMethod | stats max(ResponseTime) as Max avg(ResponseTime) as Avg perc90(Avg) as Avg90 by mainMethod

If this reply helps you an upvote is appreciated.