Splunk Search

Percentile total transactions as a percentage of total transactions

joe06031990
Communicator

Hello,

I have the bellow search:

index=test sourcetype=Test

|stats count by _time

|eventstats perc99(count) as p99

|eval Percentile  = case(count >= p99, “99%”)

|stats count by transactions by percentile 

I want to add a column that shows the % of transactions  in the 99% percentile however can’t work out how to do this. Any advice would be greatly appreciated.

 

Thanks

 

Joe

 

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

joe06031990
Communicator

That’s great, thanks for your help. 😀.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...