How to get average response time (95%,99% and 100%)

[Isaias_Garcia]

I have the below data (response time) and I need to filter it from fastest to slowest response time and then get the following: Average Response Time (95%), Average Response Time(99%) and Average Response Time(100% ). What would be the right search query on this? I tried some suggestions here but cant get the right solutions.Please help.Thank you

Response_Time
0.625
2.133
2.773
5.191
2.471
2.124
2.066
0.795
1.239
2.958
6.197
2.582
0.779
1.63
2.029
2.653
0.98
2.975
6.814
6.661
0.963
2.064
0.966
1.56

[vkari]

index=myindex1
eventName=5000 --->have b(starting time and ending time ) and reference id
eventName=5001 --->have (starting time and ending time ) and reference id

here my condition if both event names - reference id are same then,
event 5000 stating time and event 5001 ending time and total duration of time and average time I need to show in dashboards
can you please provide query

[Priya312]

Hi,

I'm also trying to get the best95, best96, best97, best98 and best99 stats for the response time avgs. Any luck on this?

[AdsicSplunk]

Hi @Isaias.Garcia,

Did you get any solution for your question? I am also having the same trouble. Could you please advise on this?

[bwooden]

Are you referring to the 95th percentile when you say average 95%?

If so, you can use the stats command's perc function (which may be abbreviated as p) along with average (avg), min and max functions. NB: All stats functions are listed here along with their description and usage notes: http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/CommonStatsFunctions

Putting them all together, you would end up with something like this (where ... represents your base search):

... | stats min(Response_Time) as RT_fastest max(Response_Time) as RT_slowest p95(Response_Time) as RT_p95 p99(Response_Time) as RT_p99 avg(Response_Time) as RT_avg

[vijaysubramania]

Thanks. I am able to get that in milliseconds but I want to convert the response time to Percent as well for reporting and compare it with earlier week, How to achieve that?