Splunk Search

Percentile total transactions as a percentage of total transactions

joe06031990
Communicator

Hello,

I have the bellow search:

index=test sourcetype=Test

|stats count by _time

|eventstats perc99(count) as p99

|eval Percentile  = case(count >= p99, “99%”)

|stats count by transactions by percentile 

I want to add a column that shows the % of transactions  in the 99% percentile however can’t work out how to do this. Any advice would be greatly appreciated.

 

Thanks

 

Joe

 

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

joe06031990
Communicator

That’s great, thanks for your help. 😀.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>