Percentile calculation

[chaitu99]

source="file.txt" | transaction startswith="message1" endswith="message2" | stats count values(duration) as DUR

log file 5 events are matching

count DUR
5 0.095
0.056
0.075
0.064
0.095

I want to calculate the percentage of all events duration coming which is less than 75 miliseconds.

Please let me know how to go ahead.

[martin_mueller · Accepted solution]

You could replace your stats with something like this:

... | stats count as total count(eval(duration<0.075)) as count | eval percentage = count * 100 / total