Splunk Search

How to build a timechart to show endpoint response time over a 95 Percentile?

jprovenzale
Explorer

Hello,

I have 3 fields from which I need to build a line chart on a Time series.

 

ServerTime

Endpoint

ResponseTime

 

I need to show  endpoint response time over a 95 percentile on servertime.

So the servertime will be on the Y-Axis, the time series on the X-Axis and a legend that shows the endpoints.

Can you please suggest a query that would achieve this.

 

Thank you

 

Labels (3)
0 Karma

jprovenzale
Explorer

Hi,

Aplologies. In my frustration I did not articulate fully.

I have actually figured it out now.

Thanks for your time.



0 Karma

jprovenzale
Explorer

Quick explanation of the issue.

I actually over complicated the problem when it was very simple.
I needed to show endpoint response times over am 99% percentile of servtime, which is the length of time of the transaction.

In the end it was a very easy query.  Set up your search and filters and the timechart line looks like this.

timechart p99(servetime) by endpoint

Thanks

VatsalJagani
SplunkTrust
SplunkTrust

@jprovenzale - If you can please post an answer with an explanation so others can get benefit from it in the future.

Also, accept your answer. Thanks!!!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You have 3 dimensions 

response time - this would typically be the Y axis

time of event - that is the X axis

servertime - what is this? and what is its relationship to response time and endpoint?

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...