I need to group results based on a threshold

[mkwan0]

I am running a query against a webserver access log. I need to group all responses greater than 5 seconds, and determine what percentage of all responses are in the above 5 second group. Any thoughts?

[mkwan0]

Ayn, thanks

I had come up with this
earliest=-y latest=now | timechart count(eval(serve_request_time_sec<5)) As WithinSLA, count(eval(serve_request_time_sec>5)) As OverSLA

Now I just need to divide the OverSLA group by OverSLA+WithinSLA. Is there a way to do that within Stats or Timechart

As you probably guessed, I am fairly new to Splunk, and reading documentation as I go.

[Ayn]

You could use stats with eval for this:

... | stats count(eval(response_time>=5)) as slow_response_count