topic Re: percentile total transactions in IIS in Splunk Search

percentile total transactions in IIS

joe06031990 — Thu, 15 Jul 2021 11:07:40 GMT

Hello,

I am trying to get the Perc99 and Perc95 from the total transaction in IIS which the bellow search:

source="C:\\inetpub\\logs\\LogFiles\\*" host="WIN-699VGN4SK4U" index="main" |bucket span=1w _time|stats count by _time|eventstats perc95(count) as p95 ,perc95(count) as p95

however it is just being the total for both, any help would be greatly appreciated.

Thanks

Joe

Re: percentile total transactions in IIS

efika — Fri, 16 Jul 2021 06:10:40 GMT

Hi @joe06031990 ,

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

Re: percentile total transactions in IIS

joe06031990 — Fri, 16 Jul 2021 06:23:39 GMT

Thanks for your help.

Re: percentile total transactions in IIS

efika — Fri, 16 Jul 2021 06:42:52 GMT

You're welcome !