Splunk Search

How to calculate perc95 Response Time

deepak02
Path Finder

Hi,

WHAT I NEED : Formula to calculate perc95 of responseTime

WHAT I HAVE:
I have a summary index which gives the below results,

alt text

To calculate the Average Response Time, I use the below formula,

alt text

The Splunk query is:
index=prod-pottery-store sourcetype=app:Potter:Performance login_type=* | eval responseTime_per_event=No_of_Events*responseTime | stats sum(responseTime_per_event) as "Total_Response_Time",sum(No_of_Events) as "Total_Events"| eval Average_Duration=Total_Response_Time/Total_Events

What formula should I use to calculate perc95 responseTime?

Thanks,
Deepak.

0 Karma

sbbadri
Motivator

try

your search | stats list(value) avg(value) median(value) perc95(value)

0 Karma

deepak02
Path Finder

Thankyou @sbbadri, this is a special case. I do not think mean(), perc95() will give us the answer.

For each responseTime, there are many No_of_Events (e.g.: 10 events for responseTime = 5, 8 events for responseTime=10).

The average responseTime is [(10 * 5) + (10*8)] / (10+8) = 7.2
mean(responseTime) is 7.5

How do I calculate perc95(responseTime) ?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

use the perc() function documented here as demonstrated in sbbadri's response.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...