Splunk Search

How to create a field of percentiles of a stats field

dragut
New Member

I have constructed a responsetime field using eval resp=endtime-startime,now I want to get a list of percentiles from 10% to 90% for this new resp field for further process. How to construct such field and also its accompanying field of number of percentiles from 10 to 90?
Thanks.

Tags (1)
0 Karma

adonio
Ultra Champion

maybe try .... | stats perc<int>(resp) as resp_<int>_percentile ....
replace <int> with your desired percentile
read here more:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Stats
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Aggregatefunctions
hope it helps

0 Karma

DalJeanis
Legend

Yes, @dragut, just do this with 9 different percentiles and you get your desired answer.

| stats perc10(resp) as resp_perc10 
    perc20(resp) as resp_perc20 
    perc30(resp) as resp_perc30 
     ....
    perc90(resp) as resp_perc90 
0 Karma

dragut
New Member

My problem is I want to construct a new field say resp_Percen which contains nine values of 10 to 90 percentile of the response time. Is there a way to consolidate the nine different fields from eval into one field so that I could use linear regression and other machine learning kit tools for furthere processing?

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...