Splunk Search

Calculate the average of 99th percentile

shashank_24
Path Finder

Hi, I am working on a query where I need to calculate the average of 99th percentile values over a 5 minute period of time for last 24 hours by serviceName.  serviceName is nothing but the web service called by consumer and i am looking to have the response time of some services.

Below is my query -

index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000 
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false

 which gives a table like this -

_timeservice1service2service3
00:051.20.82.4
00:101.70.342.8
00:151.51.23.4

 

What i want is calculate the average of these and put it in another table. Something like this -

serviceNameresponseTime
service11.37
service20.4
service32.1

 

Hope someone can help.

Labels (2)
0 Karma
1 Solution

renjith_nair
Legend

Try

 

index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000 
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

Try

 

index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3
| eval responseTime= responseTime/1000000 
| timechart span=5m p99(responseTime) as 99thPercentile by serviceName  useother=false
| untable _time,service,responseTime
| stats avg(responseTime) as responseTime by service

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

shashank_24
Path Finder

Perfect It worked like charm. Thanks @renjith_nair 

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...