Reporting

Is it possible to get percentiles in pivots?

therockhead
Path Finder

Hi,

I'm attempting to port over some searches to pivots and data models for performance reasons. One issue I'm seeing is getting the percentiles. For example the old search may have something like

| stats perc25(Duration) AS "25th Percentile", median(Duration) AS "Median", perc75(Duration) AS "75th Percentile", perc95(Duration) AS "95th Percentile" 

Is this possible in pivots?

Thanks,
Bill

Tags (2)

tpflicke
Path Finder

The pivot command currently (v6.2.1) support the median but not other percentiles.
However, if you simply want to have the reports using datamodel acceleration rather than the drag and drop features of the pivot UI the you could use tstats. The tstats command will use the tsidx files of your accellerated datamodel and you can use perc, exactperc and upperperc.

| tstats p25(Duration) AS p25 p50(Duration) AS p50 p75(Duration) AS p75 from datamodel=SomeDataModel

BTW, for something more complex you might create a pivot via the UI, run it and inspect the job which gives you the tstats command which you can then modify / develop further.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...