Insert 90th Percentile as Horizontal Line on Timechart

[danielrusso1]

New to Splunk, need some help.

I would like to build a timechart that does the following:

1. Graphs average response over a timeframe in hourly increments
2. Inserts a horizontal line representing the 90th percentile value for response time over the entire period.

I have the average response time taken care of I think:

| timechart avg(time_taken) span=1h

Any ideas?

[dwaddle]

The subsearch approach looks something like this, but it will perform (at least) twice as poorly as csharp's solution -- mainly due to having to run the main search twice. And, it's not been proven to be any more accurate.

_main_search_terms_ | timechart avg(time_taken) as avg 
| appendcols 
    [ _main_search_terms_again_ 
       | stats perc90(gers_SQL_lapse) as p90temp 
       | fields p90temp 
    ] 
| eventstats first(p90temp) as p90 
| fields - p90temp

Unless you can find a demonstrable difference in accuracy, use csharp's solution. We'd be interested to hear results with your data if there is a substantial difference in the results.

[csharp_splunk · Accepted solution]

We're having a debate about this on the IRC channel right now. This can be accomplished through a subsearch, which may provide potentially more accurate results, but I think this is just as accurate:

 * | eventstats avg(time_taken) as ttavg | eventstats p90(ttavg) as p90avg | timechart avg(time_taken) max(p90avg)