Splunk Search

90th percentile

rj1408
Path Finder

Hi I need to find 90th percentage avg, I tried by this way 

 

 

 

base search| mainMethod=LostStolen OR mainMethod=CreditLimit OR mainMethod=LoanCreation| stats max(ResponseTime) avg(ResponseTime) as count by mainMethod| eventstats perc90(avg)

 

 

 

I'm getting like this 

mainMethod       Max          avg(ResponseTime)      Avg(90p) 
 LostStolen            2000          1900                                  1834
CreditLimit          1800             1734                                  1834
LoanCreation       1925             1867                                 1834

The avg 90p is replicating from the first and if I add in eventstats as count by clause it throws error



Labels (2)
Tags (1)
0 Karma

scelikok
Champion

Hi @rj1408,

Please try this;

| stats max(ResponseTime) as Max avg(ResponseTime) as Avg perc90(ResponseTime) as Avg90p by mainMethod

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma

rj1408
Path Finder

Hi,
with perc90(responseTime), I'm unable to get avg of the response time with only top 90 response time out of 100 which is 90th percentile avg response time.

0 Karma

scelikok
Champion

Hi @rj1408,

I misunderstood your request, please try below;

| eventstats avg(ResponseTime) as Avg by mainMethod 
| stats max(ResponseTime) as Max avg(ResponseTime) as Avg perc90(Avg) as Avg90 by mainMethod

 

If this reply helps you an upvote is appreciated. 

If this reply helps you an upvote is appreciated.
0 Karma

to4kawa
SplunkTrust
SplunkTrust
| makeresults
| eval _raw="mainMethod       Max          avg_ResponseTime
LostStolen            2000          1900
CreditLimit          1800             1734
LoanCreation       1925             1867"
| multikv forceheader=1
| rename "avg_ResponseTime" as "avg(ResponseTime)"
| table mainMethod Max avg*
| rename COMMENT as "this is your table sample, check this. from here, the logic"
| eventstats perc90(eval(round('avg(ResponseTime)',1))) as "Avg(90p)"
0 Karma

rj1408
Path Finder

Hi Its still same issue, it is replecting from the first row, and it copies until the last row!

 

 

0 Karma