https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269875#M81226 <P>Have you tried any of these? <CODE>p&lt;X&gt;(Y) | perc&lt;X&gt;(Y) | exactperc&lt;X&gt;(Y) | upperperc&lt;X&gt;(Y)</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonStatsFunctions</A></P> Mon, 24 Oct 2016 14:18:06 GMT sundareshr 2016-10-24T14:18:06Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269874#M81225 <P>One of the most useful functions in Excel is percentilerank, which calculates the percentile of a value within a range of values. The closest I've been able to get is to do a p10, p20, p30, etc. and then search for everything below the value. I'm trying to show benchmarks and the function would be quite useful.</P> <P>If you're not familiar with the percentilerank function, it works as follows:</P> <UL> <LI>You specify percentilerank(value, array of values)</LI> <LI>Percentile rank returns the percentile for that value (e.g., 23rd percentile)</LI> </UL> <P>It's basically the converse of the perc commands.</P> Sat, 22 Oct 2016 16:34:35 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269874#M81225 Kenshiro70 2016-10-22T16:34:35Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269875#M81226 <P>Have you tried any of these? <CODE>p&lt;X&gt;(Y) | perc&lt;X&gt;(Y) | exactperc&lt;X&gt;(Y) | upperperc&lt;X&gt;(Y)</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/CommonStatsFunctions</A></P> Mon, 24 Oct 2016 14:18:06 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269875#M81226 sundareshr 2016-10-24T14:18:06Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269876#M81227 <P>This should be it:</P> <PRE><CODE>... | stats count by value | sort + value | streamstats current=f sum(count) as rank | fillnull rank | eventstats sum(count) as total | eval percentile_rank = rank / total * 100 </CODE></PRE> <P>This will assign each unique value its absolute rank and then convert that to percentile rank using the total number of values.</P> Sat, 29 Oct 2016 15:25:49 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269876#M81227 martin_mueller 2016-10-29T15:25:49Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269877#M81228 <P>Nice - it even accounts for duplicate values!</P> Sat, 29 Oct 2016 17:34:33 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-calculate-the-percentile-of-a-value-within-a/m-p/269877#M81228 Kenshiro70 2016-10-29T17:34:33Z