Splunk Search

Calculate the average of 99th percentile

shashank_24
Path Finder

Hi, I am working on a query where I need to calculate the average of 99th percentile values over a 5 minute period of time for last 24 hours by serviceName.  serviceName is nothing but the web service called by consumer and i am looking to have the response time of some services.

Below is my query -

index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000 
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false

 which gives a table like this -

_timeservice1service2service3
00:051.20.82.4
00:101.70.342.8
00:151.51.23.4

 

What i want is calculate the average of these and put it in another table. Something like this -

serviceNameresponseTime
service11.37
service20.4
service32.1

 

Hope someone can help.

Labels (2)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try

 

index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000 
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service

 

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

 

index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000 
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service

 

View solution in original post

0 Karma

shashank_24
Path Finder

Perfect It worked like charm. Thanks @renjith_nair 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.