Splunk Search

## Calculate the average of 99th percentile

Path Finder

Hi, I am working on a query where I need to calculate the average of 99th percentile values over a 5 minute period of time for last 24 hours by serviceName.  serviceName is nothing but the web service called by consumer and i am looking to have the response time of some services.

Below is my query -

``````index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false``````

which gives a table like this -

 _time service1 service2 service3 00:05 1.2 0.8 2.4 00:10 1.7 0.34 2.8 00:15 1.5 1.2 3.4

What i want is calculate the average of these and put it in another table. Something like this -

 serviceName responseTime service1 1.37 service2 0.4 service3 2.1

Hope someone can help.

Labels (2)

• ### timechart

Tags (4)
1 Solution
SplunkTrust

Try

``````index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service``````

SplunkTrust

Try

``````index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service``````

Path Finder

Perfect It worked like charm. Thanks @renjith_nair

Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!