Splunk Search

Percentile total transactions as a percentage of total transactions

joe06031990
Communicator

Hello,

I have the bellow search:

index=test sourcetype=Test

|stats count by _time

|eventstats perc99(count) as p99

|eval Percentile  = case(count >= p99, “99%”)

|stats count by transactions by percentile 

I want to add a column that shows the % of transactions  in the 99% percentile however can’t work out how to do this. Any advice would be greatly appreciated.

 

Thanks

 

Joe

 

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

joe06031990
Communicator

That’s great, thanks for your help. 😀.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...