Splunk Search

Can anyone please help in finding percent_rank of a field

Path Finder

Can anyone please help what could be the equivalent to SQL's "percent_Rank" command in splunk

select host, count(*) "pings",
TRUNC(PERCENT_RANK(200) WITHIN GROUP (ORDER BY proc_time) * 100, 2) || '%' "PingTime (% < 50 mSec)" from servers GROUP BY host ORDER BY 2 DESC
0 Karma

Ultra Champion
your search
| top limit=200 proc_time by host
| eval "PingTime (% < 50 mSec)"=round(percent,2)."%"

It is like this.

0 Karma

Esteemed Legend

You should just be able to pipe your data to top and get what you need:
Or, if you mean percentiles, then you can use stats percX(Y) function for that:

0 Karma


I am not familiar with that command but perhaps some of the functions in the link below could help?


0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...