Hello,
I have 3 values 15,26,18. Now assume my 18 is my latest value and i want to find p25 and p75 including the latest value by using all 3 values. If done i should one statistics with 2 column.
I tried to it by using stats and below is a picture.
Now i verified the same via internet and found the values as below.
Now i dont understaad why dont i get the same value while using streamstats, I use window=3 which shud consider all 3 value and since its streaming, shouldn't it just look at previous 3 values(current=t) and find p25 and p75?
Then why am i getting different values as below? Just look at the last row values.
I get the expected results when I use streamstats without the window option.
| makeresults
| eval value="15,26,18"
| makemv delim="," value
| mvexpand value
| fields - _time
| streamstats p25(value) p75(value)
I get the expected results when I use streamstats without the window option.
| makeresults
| eval value="15,26,18"
| makemv delim="," value
| mvexpand value
| fields - _time
| streamstats p25(value) p75(value)
Yes @richgalloway , care to explain how?
I can't explain it other that to say I tested several window values and only zero produced the expected results. It's definitely non-intuitive.