Splunk Search

How to calculate perc95 Response Time

Path Finder

Hi,

WHAT I NEED : Formula to calculate perc95 of responseTime

WHAT I HAVE:
I have a summary index which gives the below results,

alt text

To calculate the Average Response Time, I use the below formula,

alt text

The Splunk query is:
index=prod-pottery-store sourcetype=app:Potter:Performance login_type=* | eval responseTime_per_event=No_of_Events*responseTime | stats sum(responseTime_per_event) as "Total_Response_Time",sum(No_of_Events) as "Total_Events"| eval Average_Duration=Total_Response_Time/Total_Events

What formula should I use to calculate perc95 responseTime?

Thanks,
Deepak.

0 Karma

Motivator

try

your search | stats list(value) avg(value) median(value) perc95(value)

0 Karma

Path Finder

Thankyou @sbbadri, this is a special case. I do not think mean(), perc95() will give us the answer.

For each responseTime, there are many No_of_Events (e.g.: 10 events for responseTime = 5, 8 events for responseTime=10).

The average responseTime is [(10 * 5) + (10*8)] / (10+8) = 7.2
mean(responseTime) is 7.5

How do I calculate perc95(responseTime) ?

0 Karma

Splunk Employee
Splunk Employee

use the perc() function documented here as demonstrated in sbbadri's response.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!