https://community.splunk.com/t5/Splunk-Search/Percentile-total-transactions-as-a-percentage-of-total/m-p/563603#M196351 <P>That’s great, thanks for your help. <span class="lia-unicode-emoji" title=":grinning_face:">😀</span>.</P> Tue, 17 Aug 2021 08:49:30 GMT joe06031990 2021-08-17T08:49:30Z https://community.splunk.com/t5/Splunk-Search/Percentile-total-transactions-as-a-percentage-of-total/m-p/563593#M196347 <P>Hello,</P><P>I have the bellow search:</P><P>index=test sourcetype=Test</P><P>|stats count by _time</P><P>|eventstats perc99(count) as p99</P><P>|eval Percentile &nbsp;= case(count &gt;= p99, “99%”)</P><P>|stats count by transactions by percentile&nbsp;</P><P>I want to add a column that shows the % of transactions &nbsp;in the 99% percentile however can’t work out how to do this. Any advice would be greatly appreciated.</P><P>&nbsp;</P><P>Thanks</P><P>&nbsp;</P><P>Joe</P><P>&nbsp;</P> Tue, 17 Aug 2021 07:33:06 GMT https://community.splunk.com/t5/Splunk-Search/Percentile-total-transactions-as-a-percentage-of-total/m-p/563593#M196347 joe06031990 2021-08-17T07:33:06Z https://community.splunk.com/t5/Splunk-Search/Percentile-total-transactions-as-a-percentage-of-total/m-p/563599#M196349 <P>The first part generates some dummy data</P><LI-CODE lang="markup">| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 | eventstats perc99(count) as p99 | eval qualifying = case(count &lt;= p99, count) | eventstats sum(qualifying) as transactions sum(count) as total | eval percentage=100*transactions/total</LI-CODE><P>&nbsp;</P> Tue, 17 Aug 2021 07:55:51 GMT https://community.splunk.com/t5/Splunk-Search/Percentile-total-transactions-as-a-percentage-of-total/m-p/563599#M196349 ITWhisperer 2021-08-17T07:55:51Z https://community.splunk.com/t5/Splunk-Search/Percentile-total-transactions-as-a-percentage-of-total/m-p/563603#M196351 <P>That’s great, thanks for your help. <span class="lia-unicode-emoji" title=":grinning_face:">😀</span>.</P> Tue, 17 Aug 2021 08:49:30 GMT https://community.splunk.com/t5/Splunk-Search/Percentile-total-transactions-as-a-percentage-of-total/m-p/563603#M196351 joe06031990 2021-08-17T08:49:30Z