Splunk Search

How to create a field of percentiles of a stats field

dragut
New Member

I have constructed a responsetime field using eval resp=endtime-startime,now I want to get a list of percentiles from 10% to 90% for this new resp field for further process. How to construct such field and also its accompanying field of number of percentiles from 10 to 90?
Thanks.

Tags (1)
0 Karma

adonio
Ultra Champion

maybe try .... | stats perc<int>(resp) as resp_<int>_percentile ....
replace <int> with your desired percentile
read here more:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Stats
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Aggregatefunctions
hope it helps

0 Karma

DalJeanis
Legend

Yes, @dragut, just do this with 9 different percentiles and you get your desired answer.

| stats perc10(resp) as resp_perc10 
    perc20(resp) as resp_perc20 
    perc30(resp) as resp_perc30 
     ....
    perc90(resp) as resp_perc90 
0 Karma

dragut
New Member

My problem is I want to construct a new field say resp_Percen which contains nine values of 10 to 90 percentile of the response time. Is there a way to consolidate the nine different fields from eval into one field so that I could use linear regression and other machine learning kit tools for furthere processing?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...