topic Re: Why do Stats and Evenstats return different results when calculating percentiles? in Splunk Search

Why do Stats and Evenstats return different results when calculating percentiles?

MattLingwood — Tue, 29 Sep 2020 10:30:29 GMT

I am trying to work out the 99th percentile of some response times and after seeing discrepancies in a couple of search queries I have narrowed it down to the | Stats and | Eventstats command.

My Eventstats query:
source="script-output" name="MyScriptResponses"
| rename response{}.ms as response_time_ms
| mvexpand response_time_ms
| eventstats p99(response_time_ms) as "99th response time (ms)"
| table name "99th response time (ms)"
returns 200

My Stats query:
source="http-simple" name="MyScriptResponses"
| rename response{}.ms as response_time_ms
| mvexpand response_time_ms
| stats p99(response_time_ms) as "99th response time (ms)"
| table name "99th response time (ms)"
returns 190

Some info about my data:
There are 3828 response times.
It is a set time of "Previous Week"
I tried the same with Average and got the same answers.
I tried different percentiles; 75, 90, 95, 99 and only 90 returned the same data.

Re: Why do Stats and Evenstats return different results when calculating percentiles?

hliakathali_spl — Tue, 29 Sep 2020 10:27:50 GMT

"Generate summary statistics of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is pertinent to that event."

In the limits.conf file, the max_mem_usage_mb parameter is used to limit how much memory the stats and eventstats commands use to keep track of information. If the eventstats command reaches this limit, the command stops adding the requested fields to the search results. You can increase the limit, contingent on the available system memory.

Also, here are the link to the documentation files for stats and evenstats respectively:

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventstats

Re: Why do Stats and Evenstats return different results when calculating percentiles?

MattLingwood — Wed, 03 Aug 2016 12:24:48 GMT

As a Splunk cloud user I have no control over the limits.conf file. Would you recommend which is better/More accurate by default? eventstats or stats?
Thanks

Re: Why do Stats and Evenstats return different results when calculating percentiles?

hliakathali_spl — Wed, 03 Aug 2016 12:53:21 GMT

If you are using Splunk Cloud and want to change this limit, file a Support ticket.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventstats