Hi Team
I want to get the percentile 90 of the response time in splunk. Suppose I have the below response times. What is the query with which I can get the percentile 90 in Splunk
1.379
1.276
1.351
2.062
1.465
3.107
1.621
1.901
1.562
27.203
Please help on the same
Assuming the response times are stored in a field called 'response_time' that you could calculate that statistic using the p90 function in the stats command.
... | stats p90(response_time) as p90_response_time
Below are the response times. As per my understanding the 90th Percentile of the Response times should be 3.10 . But if I use the command u mentioned below it is coming as 5.51. Please help me to understand the calculation that is done to find out the 90th percentile.
1.379
1.276
1.351
2.062
1.465
3.107
1.621
1.901
1.562
27.203
An interesting point - as @richgalloway points out, it uses nearest rank method for perc(), but you will note a difference if you use exacperc90(x), which will return you 27.203
Looking at the interpolated method on that Wikiepedia page, you can see that
PC: percentile specified 0.10 0.25 0.50 0.75 0.90
N: number of scores | 10 | 10 | 10 | 10 | 10 |
OR: PC×(N+1) / PC×(N−1)+1 | 1.1/1.9 | 2.75/3.25 | 5.5/5.5 | 8.25/7.75 | 9.9/9.1 |
LoRank: OR truncated | 1/1 | 2/3 | 5/5 | 8/7 | 9/9 |
HIRank: OR rounded up | 2/2 | 3/4 | 6/6 | 9/8 | 10/10 |
The HiRank gives you the 10/10 position for a 90th percentile, which in your example, seems rather counter-intuitive.
I don't know exactly how Splunk computes the perc90 number other than using the "Nearest Rank" algorithm, but the docs at https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Aggregatefunctions#perc.26lt.3BX.... call it an estimate. You can try the exactperc90 function to see if it gives a better result.