Splunk Search

How to create a field of percentiles of a stats field

dragut
New Member

I have constructed a responsetime field using eval resp=endtime-startime,now I want to get a list of percentiles from 10% to 90% for this new resp field for further process. How to construct such field and also its accompanying field of number of percentiles from 10 to 90?
Thanks.

Tags (1)
0 Karma

adonio
Ultra Champion

maybe try .... | stats perc<int>(resp) as resp_<int>_percentile ....
replace <int> with your desired percentile
read here more:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Stats
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Aggregatefunctions
hope it helps

0 Karma

DalJeanis
Legend

Yes, @dragut, just do this with 9 different percentiles and you get your desired answer.

| stats perc10(resp) as resp_perc10 
    perc20(resp) as resp_perc20 
    perc30(resp) as resp_perc30 
     ....
    perc90(resp) as resp_perc90 
0 Karma

dragut
New Member

My problem is I want to construct a new field say resp_Percen which contains nine values of 10 to 90 percentile of the response time. Is there a way to consolidate the nine different fields from eval into one field so that I could use linear regression and other machine learning kit tools for furthere processing?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...