Average Duration and 95 percentile duration using summary index

Path Finder


I have a query like this:

(splunk_server="serverA" OR splunk_server="serverB") (app="Cargo" OR app="Customer") index="dev-cargo-app" env="DEV" site=* (sourcetype=app:Cargo:Performance) ms | stats avg(duration) as avgdur, perc95(duration) as 95perc

I am trying to make it more efficient using summary indexing:

Summary index:
(splunk_server="serverA" OR splunk_server="serverB") (app="Cargo" OR app="Customer") index="dev-cargo-app" env="DEV" site=* (sourcetype=app:Cargo:Performance OR sourcetype=app:Customer:Performance) ms
| stats count(_raw) as "No. of Events",values(duration) as "Duration" by app, site, sourcetype, category, _time

My 'efficient' query is:
index= summary report="summary_index_name" | search sourcetype=app:Cargo:Performance
| stats avg(Duration) as avgdur, perc95(Duration) as 95perc

Average duration is calculated correctly, but perc95(Duration) does not match.

My 'efficient query' gives me 100 > normal query for perc95(Duration).

Is it not possible to calculate perc95(Duration) using summary index?


Tags (1)
0 Karma


1) The biggest problem is "values(duration)". Values eliminates duplicates, so the average and percentiles will never be calculated correctly.

2) Use sistats, not stats, to populate a summary index. It will keep the "shape" of the underlying data.

See this page for more tips, and a link to a video -

0 Karma
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...