Mark 90% trend in data?

[feickertmd]

A requirement I have is to show API response times over time, marking min, max, avg and 90% range. In other words, be able to say "90% of response time are X milliseconds or lower.

Not sure how to approach it. Advice appreciated.

[feickertmd]

I don't think I am looking for percentile. I am looking for frequency.
Take, for instance, this list of 30 values:
0 0 1 1 2 2 2 3 3 4 4 4 5 5 5 5 6 6 6 7 7 7 7 8 8 8 9 9 9 9

In this case, the 90th percentile is 9, but 90% of the values are <=7.

Looking for the second figure.

[feickertmd]

and I am not a stats guy, so I may not be seeing things right!

[somesoni2]

Your original requirement says "90% of response time are X milliseconds or lower.", so perc90 is the metrics that you need which say 90% of the entries are 9 or lower (per your example).

[feickertmd]

Thanks. I have played with my sample data a bit more, and I see it better. Like I said, not a stats guy, so I wasn't surprised to find I misunderstood.

[jkat54]

🙂 we grade on a curve here.. you're fine!

[DalJeanis]

In the search reference, it's listed in the statistical/aggregate functions, and it's called percxx(), where xx in this case would be 90. If you wanted the 90th percentile of the response variable, then it would something look like

| stats min(response) as minresp, max() as maxresp, avg(response) as avgresp, perc90(response) as p90resp by ((whatever))

You should probably read the notes, since there are some interesting things about the function. It actually produces a close estimate that is cheaper and faster to calculate, but you can use exactperc90() to calculate the exact one if you really needed it.

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

[jkat54 · Accepted solution]

Please see the percX(Y) function of the stats command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

... | stats perc90(responseTimeField)