Splunk Search
Highlighted

Why result of upperperc95 are smaller than avg some times.

New Member

I am running a querie to calculate the upperperc95 and avg for the number of conections in my firewalls, but some times the result of the upperperc95 are smaller than avg results.

If the upperperc95 uses only 5% of the biggest results and does an avg of them, how they can be smaller than the avg that considers all data?

0 Karma
Highlighted

Re: Why result of upperperc95 are smaller than avg some times.

SplunkTrust
SplunkTrust

Can you provide some samples of this for us to do our own testing/math on?

Thanks!

0 Karma
Highlighted

Re: Why result of upperperc95 are smaller than avg some times.

Path Finder

upperperc 95 doesn't give the average of the top 5%. It gives an estimate of where the top 5% starts. If the biggest numbers in the top 5% are much larger than the smallest numbers in the top 5%, then the overall average can be bigger than more than 95% of the numbers in the sample.

One simple example is where 96% of your numbers are almost the same, and you have a few numbers that are much much bigger. Then your average will be bigger than at least 96% of your numbers.

See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions