https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73620#M181109 <P>Maybe filter for all values greater than the 99th percentile, and then take the 99th percentile of that:</P> <P>| eventstats perc99(Y) as ninetynine<BR /> | where Y&gt; ninetynine<BR /> | stats perc99(Y)</P> <P>However, this won't be quite right in cases that you have more than one event with the 99th percentile value.</P> Mon, 24 Jun 2013 20:15:11 GMT joebensimo 2013-06-24T20:15:11Z https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73619#M181108 <P>I would like to find the 99.99th percentile of a value.</P> <P>The perc<X>(Y) function expects X to be an integer 1-99.</X></P> <P>Any ideas?</P> Mon, 24 Jun 2013 19:46:38 GMT https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73619#M181108 yplambert 2013-06-24T19:46:38Z https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73620#M181109 <P>Maybe filter for all values greater than the 99th percentile, and then take the 99th percentile of that:</P> <P>| eventstats perc99(Y) as ninetynine<BR /> | where Y&gt; ninetynine<BR /> | stats perc99(Y)</P> <P>However, this won't be quite right in cases that you have more than one event with the 99th percentile value.</P> Mon, 24 Jun 2013 20:15:11 GMT https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73620#M181109 joebensimo 2013-06-24T20:15:11Z https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73621#M181110 <P>Using <CODE>p99.99(field)</CODE> works fine for me:</P> <PRE><CODE>index=_internal | timechart span=1h count | stats p99(count) p99.99(count) max(count) </CODE></PRE> <P>Yields this:</P> <PRE><CODE> p99(count) p99.99(count) max(count) 1 6500 7000 7879 </CODE></PRE> <P>What Splunk version are you using?</P> Mon, 24 Jun 2013 21:18:18 GMT https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73621#M181110 martin_mueller 2013-06-24T21:18:18Z https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73622#M181111 <P>You are right! I tried it and it didn't work, but I must have done something else wrong; it works fine for me now. Thanks!</P> Mon, 24 Jun 2013 21:27:55 GMT https://community.splunk.com/t5/Splunk-Search/Non-integer-percentiles/m-p/73622#M181111 yplambert 2013-06-24T21:27:55Z