Splunk Search

## Does perc95 require all the raw data for the entire interval?

Ultra Champion

Perc95 is becoming more and more popular with our executives. We wonder whether we need to have all the raw data in order to calculate it.
So, let's say we know what it is for January and next we need to know the value for January and February.
Do we need all the raw data for January and February? or we can somehow capture whatever is needed from January in a summary index and calculate based on that and the raw data for February the value for both months together.

For clarity about the perc95's definition - what does perc95 and all those stats functions perc*

Tags (3)
1 Solution
Super Champion

Hi @ddrillic,

The `percX` is based on the distribution of your results based on how many times each value appeared. If you save `percX`from January in a summary index for example you won't be able to use it to build the `percX` over January-February unless you knew the total number of count per value for January.

That being said, if you want to use summary indexing to improve performance for `perc90` then you will need to save the count per value per month. With that you can take the count per value for January, February, sum it up and then use the `perc90` on it to get the exact results.

Let me know if that helps.

Cheers,
David

Super Champion

Hi @ddrillic,

The `percX` is based on the distribution of your results based on how many times each value appeared. If you save `percX`from January in a summary index for example you won't be able to use it to build the `percX` over January-February unless you knew the total number of count per value for January.

That being said, if you want to use summary indexing to improve performance for `perc90` then you will need to save the count per value per month. With that you can take the count per value for January, February, sum it up and then use the `perc90` on it to get the exact results.

Let me know if that helps.

Cheers,
David

Ultra Champion

Very interesting David.

Super Champion

Thanks for accepting ! Happy Splunking 😉

Get Updates on the Splunk Community!

#### Discover SplunkTrust and MVP Articles, Instant Translation, and More on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

#### Integrating Kubernetes and Splunk Observability Cloud

We need end-to-end insight into our application environments to confidently ensure everything is up and ...

#### Index This | What has a tail and a head but no body?

July 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...