Splunk Dev

95 percentile

chaitu99
Explorer

How to check 95th percentile of a particular message (Ex: Message ok) which is coming 20 times.

Ex
03/22/2013 03:38:56.752 Message ok

which is coming 20 times.

Please tell me the same.

Tags (1)
0 Karma

chaitu99
Explorer

Hello
My requiremet is if "message ok" will come in log file then that is successful.

i am running it 20 times, so 20 times "message ok" will come in log.
i have to check the 95th percentile of success rate.

0 Karma

chaitu99
Explorer

Hello
My requiremet is if "message ok" will come in log file then that is successful.

i am running it 20 times, so 20 times "message ok" will come in log.
i have to check the 95th percentile of success rate.

0 Karma

lpolo
Motivator

You can use the perc()x(field) function. More information:

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

Example:
Let's say that your field OK="Message ok". Then, you could use the perc(x)(field) function as follow:

earliest=-1d@d latest=@d index=main sourcetype=messages|stats perc95(ok)

earliest=-7d@d latest=@d index=main sourcetype=messages|timechart span=d perc95(ok)

kristian_kolb
Ultra Champion

Have you checked the percX() function for stats?

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Stats
http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonStatsFunctions

your search | stats perc95(your_field) | the rest of your search

/k

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...