Dashboards & Visualizations

How to create a graph showing values for each percentile from 0 to 100?

andreacorrie
Explorer

I am trying to create a graph showing values for each percentile from 0 to 100. I know how to use the perc function but how do I plot each percentage point?

I have tried something like this without success:

| stats range(Latency) as diff | eval rank=((Latency/diff)*100) |bucket rank bins=100| table rank

I can get the range easily but am struggling with how to then rank each Latency value. Thank you in advance for the help!

Tags (3)

martin_mueller
SplunkTrust
SplunkTrust

This is only mildly hacked:

index=_internal sourcetype=splunk_web_access bytes=* | stats
  [ stats count
  | eval perc = mvrange(0,100)
  | mvexpand perc
  | eval query = "p" . if(perc < 10, "0", "") . perc . "(bytes)"
  | fields query
  | format "" "" "" "" " " ""
  ]
by sourcetype | untable sourcetype perc value | xyseries perc sourcetype value

The subsearch basically builds a huge long string:

 "p00(bytes)" "p01(bytes)" "p02(bytes)" "p03(bytes)" "p04(bytes)" "p05(bytes)" "p06(bytes)" "p07(bytes)" "p08(bytes)" "p09(bytes)" "p10(bytes)" "p11(bytes)" "p12(bytes)" "p13(bytes)" "p14(bytes)" "p15(bytes)" "p16(bytes)" "p17(bytes)" "p18(bytes)" "p19(bytes)" "p20(bytes)" "p21(bytes)" "p22(bytes)" "p23(bytes)" "p24(bytes)" "p25(bytes)" "p26(bytes)" "p27(bytes)" "p28(bytes)" "p29(bytes)" "p30(bytes)" "p31(bytes)" "p32(bytes)" "p33(bytes)" "p34(bytes)" "p35(bytes)" "p36(bytes)" "p37(bytes)" "p38(bytes)" "p39(bytes)" "p40(bytes)" "p41(bytes)" "p42(bytes)" "p43(bytes)" "p44(bytes)" "p45(bytes)" "p46(bytes)" "p47(bytes)" "p48(bytes)" "p49(bytes)" "p50(bytes)" "p51(bytes)" "p52(bytes)" "p53(bytes)" "p54(bytes)" "p55(bytes)" "p56(bytes)" "p57(bytes)" "p58(bytes)" "p59(bytes)" "p60(bytes)" "p61(bytes)" "p62(bytes)" "p63(bytes)" "p64(bytes)" "p65(bytes)" "p66(bytes)" "p67(bytes)" "p68(bytes)" "p69(bytes)" "p70(bytes)" "p71(bytes)" "p72(bytes)" "p73(bytes)" "p74(bytes)" "p75(bytes)" "p76(bytes)" "p77(bytes)" "p78(bytes)" "p79(bytes)" "p80(bytes)" "p81(bytes)" "p82(bytes)" "p83(bytes)" "p84(bytes)" "p85(bytes)" "p86(bytes)" "p87(bytes)" "p88(bytes)" "p89(bytes)" "p90(bytes)" "p91(bytes)" "p92(bytes)" "p93(bytes)" "p94(bytes)" "p95(bytes)" "p96(bytes)" "p97(bytes)" "p98(bytes)" "p99(bytes)" 

That could be typed out of course, or stored in a macro with the field name as a parameter. The untable | xyseries flips the chart around because I believe that's how you want to see it.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...