Splunk dashboard

[splunkuser_tr]

HI Team ,

i need to edit existing dashboard and need to display :

time taken for 90, 97 and 99 percentile of transaction to show in dashboard.

splunk logs look like:

tranId=testi1234556 cid=TEST-VALIDATATION-20200946101122 appId=34567usxpnsow c.a.g.t.c.http.HttpConnection.receive log="External connection ran 283 ms"

Please help on this asap.

[richgalloway]

What part do you need help with? Editing a dashboard or something else? What have you tried so far?

[splunkuser_tr]

Hi ,

I need ur help to form the query , to show the time taken for 90, percentile of transaction to show in dashboard from the logs given.

Please help me with the query.

[richgalloway]

Perhaps this will help

| rex "connection ran (?<runTime>\d+)"
| stats perc90(runTime) as perc90,perc97(runTime) as perc97,perc99(runTime) as perc99