Splunk Search

Why result of upperperc95 are smaller than avg some times.

faabiojr
New Member

I am running a querie to calculate the upperperc95 and avg for the number of conections in my firewalls, but some times the result of the upperperc95 are smaller than avg results.

If the upperperc95 uses only 5% of the biggest results and does an avg of them, how they can be smaller than the avg that considers all data?

0 Karma

ben363
Path Finder

upperperc 95 doesn't give the average of the top 5%. It gives an estimate of where the top 5% starts. If the biggest numbers in the top 5% are much larger than the smallest numbers in the top 5%, then the overall average can be bigger than more than 95% of the numbers in the sample.

One simple example is where 96% of your numbers are almost the same, and you have a few numbers that are much much bigger. Then your average will be bigger than at least 96% of your numbers.

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

Richfez
SplunkTrust
SplunkTrust

Can you provide some samples of this for us to do our own testing/math on?

Thanks!

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...