https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266590#M80140 <P>Thank you for your input!</P> Wed, 20 Jul 2016 19:32:58 GMT test365498 2016-07-20T19:32:58Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266581#M80131 <P>Hello!</P> <P>I have two separate searches that I would like to combine into one, someone able to assist, please?</P> <P>I am trying to accomplish the following: display the 95% top of events daily avg(duration) as well as the percent change of this average between today and yesterday. </P> <P>This is what I have so far:<BR /> For 95% avg: not sure<BR /> For %change: </P> <PRE><CODE>search... | bucket _time span=1d | stats avg(duration) as duration_daily by _time |delta duration_daily as change |eval change_percent=change/(duration_daily-change)*100 |timechart span=1d first(duration_daily) AS "daily avg", first(change_percent) AS "Change (%)" </CODE></PRE> <P>Anyway to combine them since I need to see the %change between the average daily values of the 95% of events?</P> <P>Thank you!</P> Wed, 20 Jul 2016 13:29:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266581#M80131 test365498 2016-07-20T13:29:26Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266582#M80132 <P>You will need to include a subsearch to accomplish this, but you gotta be careful as the performance takes a hit when doing subsearches. You will pipe the first search into <CODE>| appendcols [search SEARCH2]</CODE></P> <P>Search 1 = <CODE>index=search1 * | top(duration)</CODE><BR /> Search 2 = <CODE>index=search2. | bucket _time span=1d | stats avg(duration) as duration_daily by _time |delta duration_daily as change |eval change_percent=change/(duration_daily-change)*100 |timechart span=1d first(duration_daily) AS "daily avg", first(change_percent) AS "Change (%)"</CODE></P> <P><STRONG>Would look like this</STRONG> </P> <PRE><CODE>index=search1 * | top(duration) | appendcols [search index=search2. | bucket _time span=1d | stats avg(duration) as duration_daily by _time |delta duration_daily as change |eval change_percent=change/(duration_daily-change)*100 |timechart span=1d first(duration_daily) AS "daily avg", first(change_percent) AS "Change (%)"] </CODE></PRE> Wed, 20 Jul 2016 13:57:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266582#M80132 skoelpin 2016-07-20T13:57:59Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266583#M80133 <P>Try this</P> <PRE><CODE>base search earliest=-1d@d | eval when=if(_time&gt;relative_time(now(), "@d"), "Today", "Yesterday") | eval Time=strftime(relative_time(now(), "@d"), "%m/%d/%Y") | chart avg(duration) as duration_daily over Time by when | eval "Change (%)"=round(Yesterday/Today*100, 2) | fields - Today - Yesterday | appendcols [ search base search earliest=@d | eval Time=strftime(relative_time(now(), "@d"), "%m/%d/%Y") | chart perc5(bytes) as 95b over Time] </CODE></PRE> Wed, 20 Jul 2016 13:59:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266583#M80133 sundareshr 2016-07-20T13:59:53Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266584#M80134 <P>Something does not look right on my end. How would the search look like just for the average of events, the top 95?</P> Wed, 20 Jul 2016 14:11:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266584#M80134 test365498 2016-07-20T14:11:39Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266585#M80135 <P>Ok, I see. But issue still remains to filter out the bottom 5% and average only the top 95%.</P> Wed, 20 Jul 2016 14:12:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266585#M80135 test365498 2016-07-20T14:12:55Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266586#M80136 <P><CODE>| stats perc95(your_field)</CODE></P> Wed, 20 Jul 2016 14:14:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266586#M80136 skoelpin 2016-07-20T14:14:27Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266587#M80137 <P>perc95(duration) will give all the points in the top 95%, correct? Then how can I take the average of those?</P> Wed, 20 Jul 2016 14:19:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266587#M80137 test365498 2016-07-20T14:19:14Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266588#M80138 <P>This will only show 3 cols Time, "Change (%)" AND 95b (this is the field with 95th Percentile value. To see avg(event), remove the <CODE>fields - Today - Yesterday</CODE> The last segment should be </P> <PRE><CODE>chart perc5(duration) as 95b over Time </CODE></PRE> Wed, 20 Jul 2016 14:22:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266588#M80138 sundareshr 2016-07-20T14:22:28Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266589#M80139 <P>You can take the output of <CODE>| stats perc95(duration)</CODE> and pipe it into another command to find the average </P> <P><CODE>| stats perc95(duration) | appendcols [search stats avg(duration)]</CODE></P> Wed, 20 Jul 2016 14:23:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266589#M80139 skoelpin 2016-07-20T14:23:51Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266590#M80140 <P>Thank you for your input!</P> Wed, 20 Jul 2016 19:32:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266590#M80140 test365498 2016-07-20T19:32:58Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266591#M80141 <P>Thank you for your input!</P> Wed, 20 Jul 2016 19:33:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266591#M80141 test365498 2016-07-20T19:33:08Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266592#M80142 <P>Please accept the answer and/or upvote if this helped you </P> Wed, 20 Jul 2016 19:34:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-daily-average-of-the-top-95-of-events-and-the/m-p/266592#M80142 skoelpin 2016-07-20T19:34:07Z