Splunk Search

Insert 90th Percentile as Horizontal Line on Timechart

danielrusso1
Path Finder

New to Splunk, need some help.

I would like to build a timechart that does the following:

  1. Graphs average response over a timeframe in hourly increments
  2. Inserts a horizontal line representing the 90th percentile value for response time over the entire period.

I have the average response time taken care of I think:

| timechart avg(time_taken) span=1h

Any ideas?

Tags (1)
1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

We're having a debate about this on the IRC channel right now. This can be accomplished through a subsearch, which may provide potentially more accurate results, but I think this is just as accurate:

 * | eventstats avg(time_taken) as ttavg | eventstats p90(ttavg) as p90avg | timechart avg(time_taken) max(p90avg)

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The subsearch approach looks something like this, but it will perform (at least) twice as poorly as csharp's solution -- mainly due to having to run the main search twice. And, it's not been proven to be any more accurate.

_main_search_terms_ | timechart avg(time_taken) as avg 
| appendcols 
    [ _main_search_terms_again_ 
       | stats perc90(gers_SQL_lapse) as p90temp 
       | fields p90temp 
    ] 
| eventstats first(p90temp) as p90 
| fields - p90temp

Unless you can find a demonstrable difference in accuracy, use csharp's solution. We'd be interested to hear results with your data if there is a substantial difference in the results.

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

We're having a debate about this on the IRC channel right now. This can be accomplished through a subsearch, which may provide potentially more accurate results, but I think this is just as accurate:

 * | eventstats avg(time_taken) as ttavg | eventstats p90(ttavg) as p90avg | timechart avg(time_taken) max(p90avg)
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...