https://community.splunk.com/t5/Splunk-Search/Why-result-of-upperperc95-are-smaller-than-avg-some-times/m-p/213355#M62579 <P>upperperc 95 doesn't give the average of the top 5%. It gives an estimate of where the top 5% starts. If the biggest numbers in the top 5% are much larger than the smallest numbers in the top 5%, then the overall average can be bigger than more than 95% of the numbers in the sample.</P> <P>One simple example is where 96% of your numbers are almost the same, and you have a few numbers that are much much bigger. Then your average will be bigger than at least 96% of your numbers.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions</A></P> Fri, 03 Jun 2016 13:26:33 GMT ben363 2016-06-03T13:26:33Z https://community.splunk.com/t5/Splunk-Search/Why-result-of-upperperc95-are-smaller-than-avg-some-times/m-p/213353#M62577 <P>I am running a querie to calculate the upperperc95 and avg for the number of conections in my firewalls, but some times the result of the upperperc95 are smaller than avg results.</P> <P>If the upperperc95 uses only 5% of the biggest results and does an avg of them, how they can be smaller than the avg that considers all data? </P> Sun, 24 Apr 2016 00:03:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-result-of-upperperc95-are-smaller-than-avg-some-times/m-p/213353#M62577 faabiojr 2016-04-24T00:03:24Z https://community.splunk.com/t5/Splunk-Search/Why-result-of-upperperc95-are-smaller-than-avg-some-times/m-p/213354#M62578 <P>Can you provide some samples of this for us to do our own testing/math on?</P> <P>Thanks!</P> Sun, 24 Apr 2016 04:13:05 GMT https://community.splunk.com/t5/Splunk-Search/Why-result-of-upperperc95-are-smaller-than-avg-some-times/m-p/213354#M62578 Richfez 2016-04-24T04:13:05Z https://community.splunk.com/t5/Splunk-Search/Why-result-of-upperperc95-are-smaller-than-avg-some-times/m-p/213355#M62579 <P>upperperc 95 doesn't give the average of the top 5%. It gives an estimate of where the top 5% starts. If the biggest numbers in the top 5% are much larger than the smallest numbers in the top 5%, then the overall average can be bigger than more than 95% of the numbers in the sample.</P> <P>One simple example is where 96% of your numbers are almost the same, and you have a few numbers that are much much bigger. Then your average will be bigger than at least 96% of your numbers.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions</A></P> Fri, 03 Jun 2016 13:26:33 GMT https://community.splunk.com/t5/Splunk-Search/Why-result-of-upperperc95-are-smaller-than-avg-some-times/m-p/213355#M62579 ben363 2016-06-03T13:26:33Z