Can you help me find details of event that happens at 25% point of a search (or the nth record of a search)?

[ChrisCLewis]

Good afternoon.

I have a search that has approximately 2 million results$. I am trying to find out which record would be the 25% / 50% etc.

I do have one query that is very slow and resource intensive:

Base search |sort ProgramTime | eval x=1 | accum x  |eval b=25%number |stats values(Event_Time) as Event_Time by x |where isint(x/b) 

Is there a way to pull details directly from the nth result (which I think will be a better approach) or is there a better way to do the query?

$ (this total changes, value given as an indication of size)

Many thanks

[KailA · Accepted solution]

Hi,

You can try something like that

Base search 
| sort ProgramTime
| streamstats count as nb
| eventstats max(nb) as max
| eval quarter = round((max / 4)),
       half    = round((max / 2))
| where nb = quarter (or half or whatever you want)

You can define your own variable like half and quarter and replace them in the last | where

Let me know 🙂

[ChrisCLewis]

Works really well and very quickly.

Thank you!

Chris

[FrankVl]

Unless n needs to be dynamically calculated, something like this should get you the nth result: ... | head n | tail 1

[ChrisCLewis]

Thank you for the suggestion, it didn't quite work for me but is something I have saved for a different query I need to work on !