Splunk Search

Evaluate percentiles based on multiple rows

grizzlypolar
Loves-to-Learn Lots

I have the data in the following format

score_countscore_value
2350
4652
153
89054

with more than a 1 million score_values, each value having its distinct count. 

 

Given the data is in this format, how can I efficiently compute p95 or p99 of my the `score`. 

I tried unrolling the table to create a single column with the value repeated multiple times, but the query does not complete at all. 

Note that I'm planning to use this in a time chart command as so it has to be efficient to compute this value as well. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...