topic Re: How can I find an event count of event that are less than a p95 duration? in Splunk Search

How can I find an event count of event that are less than a p95 duration?

mark_groenveld — Tue, 07 Nov 2023 19:01:15 GMT

I need to identify the count of events that have a duration that is less than the p95 value.

Sample search

index=xyz status=complete | stats p95(dur) as p95Dur

What can I add to the end of the search to id the number of events less than the p95Dur value?

Re: How can I find an event count of event that are less than a p95 duration?

richgalloway — Tue, 07 Nov 2023 19:19:29 GMT

Use eventstats to compute the p95 value without losing the other fields.

index=xyz status=complete | eventstats p95(dur) as p95Dur | where dur < p95Dur

Re: How can I find an event count of event that are less than a p95 duration?

RobertMarks — Tue, 07 Nov 2023 20:51:13 GMT

I find doing eventstats on raw data to be tremendously slow. I'd probably compute the percentile in a subsearch and pass it through. Then you only do the percentile computation once.

index=xyz status=complete [ search index=xyz status=complete | stats p95(dur) as p95Dur | eval search = "dur>"+p95Dur | table search]

Re: How can I find an event count of event that are less than a p95 duration?

mark_groenveld — Wed, 08 Nov 2023 21:51:31 GMT

Thanks for your response Rich. Using eventstats took too long to complete to the point it wasn't usable.

Re: How can I find an event count of event that are less than a p95 duration?

mark_groenveld — Wed, 08 Nov 2023 21:54:23 GMT

Thanks Robert. I would like to clarify the search as I need the events less than the p95 duration.

Shouldn't the eval section be: | eval search = "dur<"+p95Dur

Re: How can I find an event count of event that are less than a p95 duration?

bowesmana — Wed, 08 Nov 2023 22:32:44 GMT

What do you need to retain from those events? eventstats is a slow operation as it will run on the search head, so the amount of information you need should be minimised before using that, so use the fields command to limit only those fields you need beforehand.

If that is still too slow, the subsearch approach may work for you

Re: How can I find an event count of event that are less than a p95 duration?

mark_groenveld — Thu, 09 Nov 2023 00:49:53 GMT

I need the count of events.

Re: How can I find an event count of event that are less than a p95 duration?

bowesmana — Thu, 09 Nov 2023 23:35:23 GMT

Have you tried just

so you only have the dur field in the dataset - I believe that will be significantly faster without having to pull all the data to the search head.