Splunk Search

Evaluate percentiles based on multiple rows

grizzlypolar
Loves-to-Learn Lots

I have the data in the following format

score_countscore_value
2350
4652
153
89054

with more than a 1 million score_values, each value having its distinct count. 

 

Given the data is in this format, how can I efficiently compute p95 or p99 of my the `score`. 

I tried unrolling the table to create a single column with the value repeated multiple times, but the query does not complete at all. 

Note that I'm planning to use this in a time chart command as so it has to be efficient to compute this value as well. 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

Unlock Instant Security Insights from Amazon S3 with Splunk Cloud — Try Federated ...

Availability: Must be on Splunk Cloud Platform version 10.1.2507.x to view the free trial banner. If you are ...