Splunk Search

How to add the average of the top 5 percent of values, but remove the max value, to my timechart?

jlamb3
New Member

What I have:

"Properties.MetricType"=ResponseTiming AND "Properties.Http_Request_Path"=/BackflushInputs | timechart max("Properties.ElapsedMilliseconds") avg("Properties.ElapsedMilliseconds")

This gives me a very nice graph: alt text

Because the Max value can be a significant outlier from than the rest, I'd also like to display the average of the top 5% values, minus the max value.

I've found answers to somewhat similar questions here:
https://answers.splunk.com/answers/75965/top-percentage-out-of-total-events.html
https://answers.splunk.com/answers/61711/average-time-on-only-top-results.html
...but I'm having trouble morphing them to exactly what I want. Any ideas on how I can achieve this, adding it to my current chart? Thanks!

Tags (3)
0 Karma

gokadroid
Motivator

something like:

your query to return events
| eventstats perc95(Properties.ElapsedMilliseconds) as interestedValue
| search Properties.ElapsedMilliseconds < interestedValue
| stats avg(Properties.ElapsedMilliseconds) as Avg
0 Karma

somesoni2
Revered Legend

You may want to explore function percX aggregation function available in timechart (and stats/chart). This gives the X percentile value, so if you use perc95("Properties.ElapsedMilliseconds") in your timechart, it should skip the top 5% outliers.

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/CommonStatsFunctions#Aggregate_fun...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...