Dashboards & Visualizations

Mark 90% trend in data?

feickertmd
Communicator

A requirement I have is to show API response times over time, marking min, max, avg and 90% range. In other words, be able to say "90% of response time are X milliseconds or lower.

Not sure how to approach it. Advice appreciated.

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Please see the percX(Y) function of the stats command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

... | stats perc90(responseTimeField)

View solution in original post

feickertmd
Communicator

I don't think I am looking for percentile. I am looking for frequency.
Take, for instance, this list of 30 values:
0 0 1 1 2 2 2 3 3 4 4 4 5 5 5 5 6 6 6 7 7 7 7 8 8 8 9 9 9 9

In this case, the 90th percentile is 9, but 90% of the values are <=7.

Looking for the second figure.

0 Karma

feickertmd
Communicator

and I am not a stats guy, so I may not be seeing things right!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Your original requirement says "90% of response time are X milliseconds or lower.", so perc90 is the metrics that you need which say 90% of the entries are 9 or lower (per your example).

0 Karma

feickertmd
Communicator

Thanks. I have played with my sample data a bit more, and I see it better. Like I said, not a stats guy, so I wasn't surprised to find I misunderstood.

0 Karma

jkat54
SplunkTrust
SplunkTrust

🙂 we grade on a curve here.. you're fine!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

In the search reference, it's listed in the statistical/aggregate functions, and it's called percxx(), where xx in this case would be 90. If you wanted the 90th percentile of the response variable, then it would something look like

| stats min(response) as minresp, max() as maxresp, avg(response) as avgresp, perc90(response) as p90resp by ((whatever))

You should probably read the notes, since there are some interesting things about the function. It actually produces a close estimate that is cheaper and faster to calculate, but you can use exactperc90() to calculate the exact one if you really needed it.

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please see the percX(Y) function of the stats command:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

... | stats perc90(responseTimeField)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...