https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324010#M96707 <P>Hi,</P> <P><STRONG>WHAT I NEED</STRONG> : Formula to calculate perc95 of responseTime</P> <P><STRONG>WHAT I HAVE</STRONG>:<BR /> I have a summary index which gives the below results,</P> <P><IMG src="https://community.splunk.com/storage/temp/208669-summary-index-response.png" alt="alt text" /></P> <P>To calculate the <STRONG>Average Response Time</STRONG>, I use the below formula,</P> <P><IMG src="https://community.splunk.com/storage/temp/208670-average-response-time-formula.png" alt="alt text" /></P> <P>The Splunk query is:<BR /> index=prod-pottery-store sourcetype=app:Potter:Performance login_type=* | eval responseTime_per_event=No_of_Events*responseTime | stats sum(responseTime_per_event) as "Total_Response_Time",sum(No_of_Events) as "Total_Events"| eval Average_Duration=Total_Response_Time/Total_Events</P> <P>What formula should I use to calculate perc95 responseTime?</P> <P>Thanks,<BR /> Deepak.</P> Tue, 29 Sep 2020 15:00:49 GMT deepak02 2020-09-29T15:00:49Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324010#M96707 <P>Hi,</P> <P><STRONG>WHAT I NEED</STRONG> : Formula to calculate perc95 of responseTime</P> <P><STRONG>WHAT I HAVE</STRONG>:<BR /> I have a summary index which gives the below results,</P> <P><IMG src="https://community.splunk.com/storage/temp/208669-summary-index-response.png" alt="alt text" /></P> <P>To calculate the <STRONG>Average Response Time</STRONG>, I use the below formula,</P> <P><IMG src="https://community.splunk.com/storage/temp/208670-average-response-time-formula.png" alt="alt text" /></P> <P>The Splunk query is:<BR /> index=prod-pottery-store sourcetype=app:Potter:Performance login_type=* | eval responseTime_per_event=No_of_Events*responseTime | stats sum(responseTime_per_event) as "Total_Response_Time",sum(No_of_Events) as "Total_Events"| eval Average_Duration=Total_Response_Time/Total_Events</P> <P>What formula should I use to calculate perc95 responseTime?</P> <P>Thanks,<BR /> Deepak.</P> Tue, 29 Sep 2020 15:00:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324010#M96707 deepak02 2020-09-29T15:00:49Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324011#M96708 <P>try </P> <P>your search | stats list(value) avg(value) median(value) perc95(value) </P> Mon, 24 Jul 2017 17:10:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324011#M96708 sbbadri 2017-07-24T17:10:26Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324012#M96709 <P>Thankyou <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/55793">@sbbadri</a>, this is a special case. I do not think mean(), perc95() will give us the answer.</P> <P>For each responseTime, there are many No_of_Events (e.g.: 10 events for responseTime = 5, 8 events for responseTime=10). </P> <P>The average responseTime is [(10 * 5) + (10*8)] / (10+8) = 7.2<BR /> mean(responseTime) is 7.5</P> <P>How do I calculate perc95(responseTime) ?</P> Tue, 29 Sep 2020 15:00:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324012#M96709 deepak02 2020-09-29T15:00:55Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324013#M96710 <P>use the perc() function <A href="http://docs.splunk.com/Documentation/Splunk/6.6.1/SearchReference/Aggregatefunctions#percentile_.3CX.3E.28Y.29">documented here</A> as demonstrated in sbbadri's response.</P> Mon, 24 Jul 2017 18:30:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-perc95-Response-Time/m-p/324013#M96710 s2_splunk 2017-07-24T18:30:44Z