Splunk Search

Why do Stats and Evenstats return different results when calculating percentiles?

MattLingwood
Engager

I am trying to work out the 99th percentile of some response times and after seeing discrepancies in a couple of search queries I have narrowed it down to the | Stats and | Eventstats command.

My Eventstats query:
source="script-output" name="MyScriptResponses"
| rename response{}.ms as response_time_ms
| mvexpand response_time_ms
| eventstats p99(response_time_ms) as "99th response time (ms)"
| table name "99th response time (ms)"
returns 200

My Stats query:
source="http-simple" name="MyScriptResponses"
| rename response{}.ms as response_time_ms
| mvexpand response_time_ms
| stats p99(response_time_ms) as "99th response time (ms)"
| table name "99th response time (ms)"
returns 190

Some info about my data:
There are 3828 response times.
It is a set time of "Previous Week"
I tried the same with Average and got the same answers.
I tried different percentiles; 75, 90, 95, 99 and only 90 returned the same data.

0 Karma
1 Solution

hliakathali_spl
Splunk Employee
Splunk Employee

"Generate summary statistics of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is pertinent to that event."

In the limits.conf file, the max_mem_usage_mb parameter is used to limit how much memory the stats and eventstats commands use to keep track of information. If the eventstats command reaches this limit, the command stops adding the requested fields to the search results. You can increase the limit, contingent on the available system memory.

Also, here are the link to the documentation files for stats and evenstats respectively:

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventstats

View solution in original post

hliakathali_spl
Splunk Employee
Splunk Employee

"Generate summary statistics of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is pertinent to that event."

In the limits.conf file, the max_mem_usage_mb parameter is used to limit how much memory the stats and eventstats commands use to keep track of information. If the eventstats command reaches this limit, the command stops adding the requested fields to the search results. You can increase the limit, contingent on the available system memory.

Also, here are the link to the documentation files for stats and evenstats respectively:

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Stats
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventstats

MattLingwood
Engager

As a Splunk cloud user I have no control over the limits.conf file. Would you recommend which is better/More accurate by default? eventstats or stats?
Thanks

0 Karma

hliakathali_spl
Splunk Employee
Splunk Employee

If you are using Splunk Cloud and want to change this limit, file a Support ticket.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Eventstats

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...