https://community.splunk.com/t5/Splunk-Search/Percentile-calculation/m-p/64931#M16035 <P>You could replace your stats with something like this:</P> <PRE><CODE>... | stats count as total count(eval(duration&lt;0.075)) as count | eval percentage = count * 100 / total </CODE></PRE> Mon, 18 Mar 2013 12:29:59 GMT martin_mueller 2013-03-18T12:29:59Z https://community.splunk.com/t5/Splunk-Search/Percentile-calculation/m-p/64930#M16034 <P>source="file.txt" | transaction startswith="message1" endswith="message2" | stats count values(duration) as DUR</P> <P>log file 5 events are matching</P> <P>count DUR <BR /> 5 0.095<BR /> 0.056<BR /> 0.075<BR /> 0.064<BR /> 0.095</P> <P>I want to calculate the percentage of all events duration coming which is less than 75 miliseconds.</P> <P>Please let me know how to go ahead.</P> Mon, 18 Mar 2013 12:14:06 GMT https://community.splunk.com/t5/Splunk-Search/Percentile-calculation/m-p/64930#M16034 chaitu99 2013-03-18T12:14:06Z https://community.splunk.com/t5/Splunk-Search/Percentile-calculation/m-p/64931#M16035 <P>You could replace your stats with something like this:</P> <PRE><CODE>... | stats count as total count(eval(duration&lt;0.075)) as count | eval percentage = count * 100 / total </CODE></PRE> Mon, 18 Mar 2013 12:29:59 GMT https://community.splunk.com/t5/Splunk-Search/Percentile-calculation/m-p/64931#M16035 martin_mueller 2013-03-18T12:29:59Z