https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688558#M234734 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/259105">@Chirag812</a>&nbsp;,</P><P>good for you, see next time!</P><P>let me know if I can help you more, or, please, accept one answer for the other people of Community.</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 24 May 2024 05:51:03 GMT gcusello 2024-05-24T05:51:03Z https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688469#M234713 <LI-CODE lang="markup">index=abc sourcetype=abc | timechart span=1m eval(count(IP)) AS TimeTaken</LI-CODE> <P>Now I want to get 95th percentile of this total IP counts. like below.</P> <LI-CODE lang="markup">| stats perc95(TimeTaken) as Perc_95 by IP</LI-CODE> <P>So how should I write this query ?</P> Thu, 23 May 2024 14:37:12 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688469#M234713 Chirag812 2024-05-23T14:37:12Z https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688479#M234717 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/259105">@Chirag812</a>&nbsp;,</P><P>I cannot test it, but it should work:</P><LI-CODE lang="markup">index=abc sourcetype=abc | bin span=1m _time | stats count AS TimeTaken BY IP _time | timechart perc95(TimeTaken) AS Perc_95 by IP</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Thu, 23 May 2024 14:48:13 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688479#M234717 gcusello 2024-05-23T14:48:13Z https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688495#M234722 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Chirag812_0-1716482096284.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/30948i95E8C550C571B385/image-size/medium?v=v2&amp;px=400" role="button" title="Chirag812_0-1716482096284.png" alt="Chirag812_0-1716482096284.png" /></span></P><P>Look like this is worked with this query.</P><P>Thank you so much for the quick and useful response.</P> Thu, 23 May 2024 16:35:31 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688495#M234722 Chirag812 2024-05-23T16:35:31Z https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688558#M234734 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/259105">@Chirag812</a>&nbsp;,</P><P>good for you, see next time!</P><P>let me know if I can help you more, or, please, accept one answer for the other people of Community.</P><P>Ciao and happy splunking</P><P>Giuseppe</P><P>P.S.: Karma Points are appreciated <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 24 May 2024 05:51:03 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Query-Issue/m-p/688558#M234734 gcusello 2024-05-24T05:51:03Z