Splunk Search

## How to search the 90th percentile value in a series of values and the count of values that are greater than the 90th percentile?

Path Finder

I need the 90th percentile value in a series of values and the count of values that are greater than the 90th percentile...

index=jms_logs sourcetype=perflogs domain_server_port="proda_olb_osb*" service_name="ABC*" | eventstats perc95(response_time) as response_time_95p | stats count by service_name | where response_time>response_time_98p

Tags (3)
1 Solution
Legend

Try this

``````index=jms_logs sourcetype=perflogs domain_server_port="proda_olb_osb*" service_name="ABC*"
| eventstats perc90(response_time) as response_time_90p
| where response_time>response_time_90p
| stats count by service_name
``````

First, you had a typo, but you also had the commands a bit out of order. This calculates the 90th percentile of response time across all services and events, then counts the events that exceed the 90th percentile by service. If you want the 90th percentile to also be based on the service, rather than overall, then try this

``````index=jms_logs sourcetype=perflogs domain_server_port="proda_olb_osb*" service_name="ABC*"
| eventstats perc90(response_time) as response_time_90p  by service_name
| where response_time>response_time_90p
| stats count by service_name
``````
Legend

Try this

``````index=jms_logs sourcetype=perflogs domain_server_port="proda_olb_osb*" service_name="ABC*"
| eventstats perc90(response_time) as response_time_90p
| where response_time>response_time_90p
| stats count by service_name
``````

First, you had a typo, but you also had the commands a bit out of order. This calculates the 90th percentile of response time across all services and events, then counts the events that exceed the 90th percentile by service. If you want the 90th percentile to also be based on the service, rather than overall, then try this

``````index=jms_logs sourcetype=perflogs domain_server_port="proda_olb_osb*" service_name="ABC*"
| eventstats perc90(response_time) as response_time_90p  by service_name
| where response_time>response_time_90p
| stats count by service_name
``````
Path Finder

Also, i would like to set limits on 90p value for individual services (there are about 60-70) and alert if the 90p value goes above the set limit or if the count above 90p is higher than set limit.

Can you please suggest how this can be achieved.
Thanks a lot.

Path Finder

it worked. Thanks a lot.

Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!