I have a query like this
sourcetype=tseltdw tags{}= "request"
| fillnull data.service,data.service1, api_revamp,data.status, tags{}, keyword, keyword_api,data.timeTaken
| eval keyword_api=if(keyword LIKE "user/628%" OR keyword LIKE "user/08%" ,"user/msisdn",keyword)
| eval data.service1= if(len('data.service')>200, "null",'data.service')
| eval datex=strftime(_time,"%Y-%m-%d")
| eval datetime=strftime(_time,"%Y-%m-%d %H:00:00")
| eval hourx=strftime(_time,"%H") | eval data.uri3= if(len('data.uri2')>100, "null",'data.uri2')
| stats count as trx by datex, hourx, datetime, data.service1, data.status, tags{}, data._id, keyword_api,api_revamp, data.timeTaken
| sort data.timeTaken asc
and return like this.
Can anyone help me how to return one value only with p90 percentile by data.timeTaken?
Much appreciated for any help, thank you.
