Splunk Search

Can anyone please help in finding percent_rank of a field

sahil237888
Path Finder

Can anyone please help what could be the equivalent to SQL's "percent_Rank" command in splunk

select host, count(*) "pings",
TRUNC(PERCENT_RANK(200) WITHIN GROUP (ORDER BY proc_time) * 100, 2) || '%' "PingTime (% < 50 mSec)" from servers GROUP BY host ORDER BY 2 DESC
0 Karma

to4kawa
SplunkTrust
SplunkTrust
your search
| top limit=200 proc_time by host
| eval "PingTime (% < 50 mSec)"=round(percent,2)."%"

It is like this.

0 Karma

woodcock
Esteemed Legend

You should just be able to pipe your data to top and get what you need:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top
Or, if you mean percentiles, then you can use stats percX(Y) function for that:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Aggregatefunctions#perc.26lt.3BX...

0 Karma

oscar84x
Contributor

I am not familiar with that command but perhaps some of the functions in the link below could help?

https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Aggregatefunctions

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!