Dashboards & Visualizations

How to create a graph showing values for each percentile from 0 to 100?

andreacorrie
Explorer

I am trying to create a graph showing values for each percentile from 0 to 100. I know how to use the perc function but how do I plot each percentage point?

I have tried something like this without success:

| stats range(Latency) as diff | eval rank=((Latency/diff)*100) |bucket rank bins=100| table rank

I can get the range easily but am struggling with how to then rank each Latency value. Thank you in advance for the help!

Tags (3)

martin_mueller
SplunkTrust
SplunkTrust

This is only mildly hacked:

index=_internal sourcetype=splunk_web_access bytes=* | stats
  [ stats count
  | eval perc = mvrange(0,100)
  | mvexpand perc
  | eval query = "p" . if(perc < 10, "0", "") . perc . "(bytes)"
  | fields query
  | format "" "" "" "" " " ""
  ]
by sourcetype | untable sourcetype perc value | xyseries perc sourcetype value

The subsearch basically builds a huge long string:

 "p00(bytes)" "p01(bytes)" "p02(bytes)" "p03(bytes)" "p04(bytes)" "p05(bytes)" "p06(bytes)" "p07(bytes)" "p08(bytes)" "p09(bytes)" "p10(bytes)" "p11(bytes)" "p12(bytes)" "p13(bytes)" "p14(bytes)" "p15(bytes)" "p16(bytes)" "p17(bytes)" "p18(bytes)" "p19(bytes)" "p20(bytes)" "p21(bytes)" "p22(bytes)" "p23(bytes)" "p24(bytes)" "p25(bytes)" "p26(bytes)" "p27(bytes)" "p28(bytes)" "p29(bytes)" "p30(bytes)" "p31(bytes)" "p32(bytes)" "p33(bytes)" "p34(bytes)" "p35(bytes)" "p36(bytes)" "p37(bytes)" "p38(bytes)" "p39(bytes)" "p40(bytes)" "p41(bytes)" "p42(bytes)" "p43(bytes)" "p44(bytes)" "p45(bytes)" "p46(bytes)" "p47(bytes)" "p48(bytes)" "p49(bytes)" "p50(bytes)" "p51(bytes)" "p52(bytes)" "p53(bytes)" "p54(bytes)" "p55(bytes)" "p56(bytes)" "p57(bytes)" "p58(bytes)" "p59(bytes)" "p60(bytes)" "p61(bytes)" "p62(bytes)" "p63(bytes)" "p64(bytes)" "p65(bytes)" "p66(bytes)" "p67(bytes)" "p68(bytes)" "p69(bytes)" "p70(bytes)" "p71(bytes)" "p72(bytes)" "p73(bytes)" "p74(bytes)" "p75(bytes)" "p76(bytes)" "p77(bytes)" "p78(bytes)" "p79(bytes)" "p80(bytes)" "p81(bytes)" "p82(bytes)" "p83(bytes)" "p84(bytes)" "p85(bytes)" "p86(bytes)" "p87(bytes)" "p88(bytes)" "p89(bytes)" "p90(bytes)" "p91(bytes)" "p92(bytes)" "p93(bytes)" "p94(bytes)" "p95(bytes)" "p96(bytes)" "p97(bytes)" "p98(bytes)" "p99(bytes)" 

That could be typed out of course, or stored in a macro with the field name as a parameter. The untable | xyseries flips the chart around because I believe that's how you want to see it.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...