Why result of upperperc95 are smaller than avg some times.

[faabiojr]

I am running a querie to calculate the upperperc95 and avg for the number of conections in my firewalls, but some times the result of the upperperc95 are smaller than avg results.

If the upperperc95 uses only 5% of the biggest results and does an avg of them, how they can be smaller than the avg that considers all data?

[ben363]

upperperc 95 doesn't give the average of the top 5%. It gives an estimate of where the top 5% starts. If the biggest numbers in the top 5% are much larger than the smallest numbers in the top 5%, then the overall average can be bigger than more than 95% of the numbers in the sample.

One simple example is where 96% of your numbers are almost the same, and you have a few numbers that are much much bigger. Then your average will be bigger than at least 96% of your numbers.

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

[Richfez]

Can you provide some samples of this for us to do our own testing/math on?

Thanks!