Splunk Search

How do I set an alert when 95th percentile is over the threshold?

mlui_2
Explorer

Hi all,

Here is my base search

index=java  location=APICall api_method=POST Duration |stats   median(Duration) as median, perc70(Duration) as p70, perc90(Duration) as p90, perc95(Duration) as p95, perc99(Duration) as p99 

How do I set an alert when 95th percentile is over let's say 30000ms ?

Thanks in advance

1 Solution

pjdwyer
Explorer

If I understand your data correctly you would want to add a where statement before the stats statement.

| where perc95(duration) > 30000

and if you want to add more clauses to the statement you can do it this way:

| where (perc70(duration) > 30000) OR (perc90(duration) > 30000) OR (perc95(duration) > 30000) OR (perc99(duration) > 30000)

This statement will remove any information that does not meet the said criteria.

View solution in original post

mlui_2
Explorer

index=java location=APICall api_method=POST Duration |timechart span=5m perc95(Duration) as P95| where P95> 30000ms

0 Karma

mlui_2
Explorer

got it

timechart span=5m perc95(Duration) as P95 | where P95>30000ms

0 Karma

pjdwyer
Explorer

If I understand your data correctly you would want to add a where statement before the stats statement.

| where perc95(duration) > 30000

and if you want to add more clauses to the statement you can do it this way:

| where (perc70(duration) > 30000) OR (perc90(duration) > 30000) OR (perc95(duration) > 30000) OR (perc99(duration) > 30000)

This statement will remove any information that does not meet the said criteria.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...