How to get the percentile 90 of the response time in Splunk?

[Subarna]

Hi Team

 I want to get the percentile 90 of the response time in splunk. Suppose I have the below response times. What is the query with which I can get the percentile 90 in Splunk

1.379
1.276
1.351
2.062
1.465
3.107
1.621
1.901
1.562
27.203

Please help on the same

[richgalloway]

Assuming the response times are stored in a field called 'response_time' that you could calculate that statistic using the p90 function in the stats command.

... | stats p90(response_time) as p90_response_time

[Subarna]

hi @richgalloway 

Below are the response times. As per my understanding the 90th Percentile of the Response times should be 3.10 . But if I use the command u mentioned below it is coming as 5.51. Please help me to understand the calculation that is done to find out the 90th percentile.

1.379
1.276
1.351
2.062
1.465
3.107
1.621
1.901
1.562
27.203

[bowesmana]

An interesting point - as @richgalloway points out, it uses nearest rank method for perc(), but you will note a difference if you use exacperc90(x), which will return you 27.203

Looking at the interpolated method on that Wikiepedia page, you can see that

PC: percentile specified 0.10 0.25 0.50 0.75 0.90

N: number of scores	10	10	10	10	10
OR: PC×(N+1) / PC×(N−1)+1	1.1/1.9	2.75/3.25	5.5/5.5	8.25/7.75	9.9/9.1
LoRank: OR truncated	1/1	2/3	5/5	8/7	9/9
HIRank: OR rounded up	2/2	3/4	6/6	9/8	10/10

The HiRank gives you the 10/10 position for a 90th percentile, which in your example, seems rather counter-intuitive.

[richgalloway]

I don't know exactly how Splunk computes the perc90 number other than using the "Nearest Rank" algorithm, but the docs at https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/Aggregatefunctions#perc.26lt.3BX.... call it an estimate.  You can try the exactperc90 function to see if it gives a better result.