Is there anyway to get the p(95) of URI1, URI2, URI3 if the p(95) of URI4 is greater than 2sec?

[PriA]

Hi,

Is there anyway to get the p(95) of URI1, URI2, URI3 if the p(95) of URI4 is greater than 2sec.
I tried the below query, but it’s giving the p(95) on only those URIs whose p(95)>2. I’m expecting p(95) of all URI1, URI2, URI3 if the condition is sarisfied

index=myindex URI in (URI1, URI2, URI3, URI4) | stats perc95(responsetime) as p95 by URI | where p95>2

[bowesmana · Accepted solution]

The search produces a table with 4 rows, 2 columns with URI and p95 fields

so after the stats, so this

| transpose header_field=URI
| where URI4>2