topic Re: How to get average response time (95%,99% and 100%) in Splunk Search

How to get average response time (95%,99% and 100%)

Isaias_Garcia — Tue, 19 Aug 2014 01:39:56 GMT

I have the below data (response time) and I need to filter it from fastest to slowest response time and then get the following: Average Response Time (95%), Average Response Time(99%) and Average Response Time(100% ). What would be the right search query on this? I tried some suggestions here but cant get the right solutions.Please help.Thank you

Response_Time
0.625
2.133
2.773
5.191
2.471
2.124
2.066
0.795
1.239
2.958
6.197
2.582
0.779
1.63
2.029
2.653
0.98
2.975
6.814
6.661
0.963
2.064
0.966
1.56

Re: How to get average response time (95%,99% and 100%)

bwooden — Tue, 19 Aug 2014 02:59:37 GMT

Are you referring to the 95th percentile when you say average 95%?

If so, you can use the stats command's perc function (which may be abbreviated as p) along with average (avg), min and max functions. NB: All stats functions are listed here along with their description and usage notes: http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonStatsFunctions

Putting them all together, you would end up with something like this (where ... represents your base search):

... | stats min(Response_Time) as RT_fastest max(Response_Time) as RT_slowest p95(Response_Time) as RT_p95 p99(Response_Time) as RT_p99 avg(Response_Time) as RT_avg

Re: How to get average response time (95%,99% and 100%)

Priya312 — Thu, 26 Feb 2015 05:27:37 GMT

Hi,

I'm also trying to get the best95, best96, best97, best98 and best99 stats for the response time avgs. Any luck on this?

Re: How to get average response time (95%,99% and 100%)

AdsicSplunk — Wed, 28 Feb 2018 09:45:41 GMT

Hi @Isaias.Garcia,

Did you get any solution for your question? I am also having the same trouble. Could you please advise on this?

Re: How to get average response time (95%,99% and 100%)

vkari — Mon, 28 Jan 2019 04:41:00 GMT

index=myindex1
eventName=5000 --->have b(starting time and ending time ) and reference id
eventName=5001 --->have (starting time and ending time ) and reference id

here my condition if both event names - reference id are same then,
event 5000 stating time and event 5001 ending time and total duration of time and average time I need to show in dashboards
can you please provide query

Re: How to get average response time (95%,99% and 100%)

vijaysubramania — Mon, 22 Jun 2020 18:05:38 GMT

Thanks. I am able to get that in milliseconds but I want to convert the response time to Percent as well for reporting and compare it with earlier week, How to achieve that?