How to create a graph showing values for each percentile from 0 to 100?

[andreacorrie]

I am trying to create a graph showing values for each percentile from 0 to 100. I know how to use the perc function but how do I plot each percentage point?

I have tried something like this without success:

| stats range(Latency) as diff | eval rank=((Latency/diff)*100) |bucket rank bins=100| table rank

I can get the range easily but am struggling with how to then rank each Latency value. Thank you in advance for the help!

[martin_mueller]

This is only mildly hacked:

index=_internal sourcetype=splunk_web_access bytes=* | stats
  [ stats count
  | eval perc = mvrange(0,100)
  | mvexpand perc
  | eval query = "p" . if(perc < 10, "0", "") . perc . "(bytes)"
  | fields query
  | format "" "" "" "" " " ""
  ]
by sourcetype | untable sourcetype perc value | xyseries perc sourcetype value

The subsearch basically builds a huge long string:

 "p00(bytes)" "p01(bytes)" "p02(bytes)" "p03(bytes)" "p04(bytes)" "p05(bytes)" "p06(bytes)" "p07(bytes)" "p08(bytes)" "p09(bytes)" "p10(bytes)" "p11(bytes)" "p12(bytes)" "p13(bytes)" "p14(bytes)" "p15(bytes)" "p16(bytes)" "p17(bytes)" "p18(bytes)" "p19(bytes)" "p20(bytes)" "p21(bytes)" "p22(bytes)" "p23(bytes)" "p24(bytes)" "p25(bytes)" "p26(bytes)" "p27(bytes)" "p28(bytes)" "p29(bytes)" "p30(bytes)" "p31(bytes)" "p32(bytes)" "p33(bytes)" "p34(bytes)" "p35(bytes)" "p36(bytes)" "p37(bytes)" "p38(bytes)" "p39(bytes)" "p40(bytes)" "p41(bytes)" "p42(bytes)" "p43(bytes)" "p44(bytes)" "p45(bytes)" "p46(bytes)" "p47(bytes)" "p48(bytes)" "p49(bytes)" "p50(bytes)" "p51(bytes)" "p52(bytes)" "p53(bytes)" "p54(bytes)" "p55(bytes)" "p56(bytes)" "p57(bytes)" "p58(bytes)" "p59(bytes)" "p60(bytes)" "p61(bytes)" "p62(bytes)" "p63(bytes)" "p64(bytes)" "p65(bytes)" "p66(bytes)" "p67(bytes)" "p68(bytes)" "p69(bytes)" "p70(bytes)" "p71(bytes)" "p72(bytes)" "p73(bytes)" "p74(bytes)" "p75(bytes)" "p76(bytes)" "p77(bytes)" "p78(bytes)" "p79(bytes)" "p80(bytes)" "p81(bytes)" "p82(bytes)" "p83(bytes)" "p84(bytes)" "p85(bytes)" "p86(bytes)" "p87(bytes)" "p88(bytes)" "p89(bytes)" "p90(bytes)" "p91(bytes)" "p92(bytes)" "p93(bytes)" "p94(bytes)" "p95(bytes)" "p96(bytes)" "p97(bytes)" "p98(bytes)" "p99(bytes)" 

That could be typed out of course, or stored in a macro with the field name as a parameter. The untable | xyseries flips the chart around because I believe that's how you want to see it.