https://community.splunk.com/t5/Splunk-Search/How-to-return-exact-percentile-values-in-a-Splunk-search/m-p/195971#M187339 <P>I'm pretty sure that both <CODE>perc()</CODE> and <CODE>exactperc()</CODE> use the Nearest Rank method: <A href="https://en.wikipedia.org/wiki/Percentile#The_Nearest_Rank_method">https://en.wikipedia.org/wiki/Percentile#The_Nearest_Rank_method</A><BR /> The difference appears to be that for high-cardinality fields <CODE>perc()</CODE> might not be accurate for sake of performance so you can use <CODE>exactperc()</CODE> to force Splunk to be accurate (within the Nearest Rank method) without regard for expensive computations.</P> Thu, 09 Jul 2015 00:48:26 GMT martin_mueller 2015-07-09T00:48:26Z https://community.splunk.com/t5/Splunk-Search/How-to-return-exact-percentile-values-in-a-Splunk-search/m-p/195970#M187338 <P>Hi, </P> <P>I have an issue with percentile functions provided by SPLUNK.</P> <P>Example: I am getting count by last 7 days as :</P> <P>11,12,13,14,16,18,22</P> <P>If I am asking for 90th perc of above value, it's always showing me 22 as a value, not in between like 20 or 21, or if I expect the 80th percentile, it's giving me 18, not 19 or 20. This means it's taking data from the result set, not in between and I'm expecting exact percentiles. Could you please help me to know how we could achieve this in splunk ? </P> <P>I tried all functions provided by Splunk like <CODE>perc</CODE>, <CODE>p</CODE>, <CODE>exactperc</CODE> etc. but results are not changing. </P> Wed, 08 Jul 2015 19:13:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-exact-percentile-values-in-a-Splunk-search/m-p/195970#M187338 rameshlpatel 2015-07-08T19:13:11Z https://community.splunk.com/t5/Splunk-Search/How-to-return-exact-percentile-values-in-a-Splunk-search/m-p/195971#M187339 <P>I'm pretty sure that both <CODE>perc()</CODE> and <CODE>exactperc()</CODE> use the Nearest Rank method: <A href="https://en.wikipedia.org/wiki/Percentile#The_Nearest_Rank_method">https://en.wikipedia.org/wiki/Percentile#The_Nearest_Rank_method</A><BR /> The difference appears to be that for high-cardinality fields <CODE>perc()</CODE> might not be accurate for sake of performance so you can use <CODE>exactperc()</CODE> to force Splunk to be accurate (within the Nearest Rank method) without regard for expensive computations.</P> Thu, 09 Jul 2015 00:48:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-exact-percentile-values-in-a-Splunk-search/m-p/195971#M187339 martin_mueller 2015-07-09T00:48:26Z