Hi I need to find 90th percentage avg, I tried by this way
base search| mainMethod=LostStolen OR mainMethod=CreditLimit OR mainMethod=LoanCreation| stats max(ResponseTime) avg(ResponseTime) as count by mainMethod| eventstats perc90(avg)
I'm getting like this
mainMethod Max avg(ResponseTime) Avg(90p)
LostStolen 2000 1900 1834
CreditLimit 1800 1734 1834
LoanCreation 1925 1867 1834
The avg 90p is replicating from the first and if I add in eventstats as count by clause it throws error
Hi @rj1408,
Please try this;
| stats max(ResponseTime) as Max avg(ResponseTime) as Avg perc90(ResponseTime) as Avg90p by mainMethod
If this reply helps you an upvote is appreciated.
Hi,
with perc90(responseTime), I'm unable to get avg of the response time with only top 90 response time out of 100 which is 90th percentile avg response time.
Hi @rj1408,
I misunderstood your request, please try below;
| eventstats avg(ResponseTime) as Avg by mainMethod
| stats max(ResponseTime) as Max avg(ResponseTime) as Avg perc90(Avg) as Avg90 by mainMethod
If this reply helps you an upvote is appreciated.
| makeresults
| eval _raw="mainMethod Max avg_ResponseTime
LostStolen 2000 1900
CreditLimit 1800 1734
LoanCreation 1925 1867"
| multikv forceheader=1
| rename "avg_ResponseTime" as "avg(ResponseTime)"
| table mainMethod Max avg*
| rename COMMENT as "this is your table sample, check this. from here, the logic"
| eventstats perc90(eval(round('avg(ResponseTime)',1))) as "Avg(90p)"
Hi Its still same issue, it is replecting from the first row, and it copies until the last row!