Splunk Query Issue

[Chirag812]

index=abc sourcetype=abc

| timechart span=1m eval(count(IP)) AS TimeTaken

Now I want to get 95th percentile of this total IP counts. like below.

| stats perc95(TimeTaken) as Perc_95 by IP

So how should I write this query ?

[Chirag812]

Look like this is worked with this query.

Thank you so much for the quick and useful response.

[gcusello]

Hi @Chirag812 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @Chirag812 ,

I cannot test it, but it should work:

index=abc sourcetype=abc
| bin span=1m _time
| stats count AS TimeTaken BY IP _time
| timechart perc95(TimeTaken) AS Perc_95 by IP

Ciao.

Giuseppe