Splunk Search

How to calculate perc95 Response Time

deepak02
Path Finder

Hi,

WHAT I NEED : Formula to calculate perc95 of responseTime

WHAT I HAVE:
I have a summary index which gives the below results,

alt text

To calculate the Average Response Time, I use the below formula,

alt text

The Splunk query is:
index=prod-pottery-store sourcetype=app:Potter:Performance login_type=* | eval responseTime_per_event=No_of_Events*responseTime | stats sum(responseTime_per_event) as "Total_Response_Time",sum(No_of_Events) as "Total_Events"| eval Average_Duration=Total_Response_Time/Total_Events

What formula should I use to calculate perc95 responseTime?

Thanks,
Deepak.

0 Karma

sbbadri
Motivator

try

your search | stats list(value) avg(value) median(value) perc95(value)

0 Karma

deepak02
Path Finder

Thankyou @sbbadri, this is a special case. I do not think mean(), perc95() will give us the answer.

For each responseTime, there are many No_of_Events (e.g.: 10 events for responseTime = 5, 8 events for responseTime=10).

The average responseTime is [(10 * 5) + (10*8)] / (10+8) = 7.2
mean(responseTime) is 7.5

How do I calculate perc95(responseTime) ?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

use the perc() function documented here as demonstrated in sbbadri's response.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...