Splunk Search

grouping requests by percentile

joe06031990
Communicator

Good morning, 

 

I am trying to group the count by percentile however all is showing in 0% which is in correct: 

source="C:\\inetpub\\logs\\LogFiles\\*" host="WIN-699VGN4SK4U" index="main" |bucket span=1d _time| eventstats p75(count) as p75 p95(count) as p95 p99(count) as p99
| eval Percentile = case(count >= p75, "75%", count >= p95, "95%", count >= p99, "99%", 1=1, "0%")
| stats count by Percentile

Not really sure how to fix, any help would be greatly appreciated.

 

Thanks

 

Joe

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You have not included _time in the stats so you will get a single result

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

count isn't created in your search - does it already exist in your events?

Also, you should change the order in the case statement since over 95% is also over 75% so would be tagged as being over 75% before it gets to evaluate whether it is over 95%

0 Karma

joe06031990
Communicator

Thanks for your reply, I have re-wrote my search:

 

index=test sourcetype=test |bucket span=1m _time
| stats count as total
| eventstats perc99(total) as p99, perc95(total),perc75(total) as p75| eval Percentile = case(total >= p99, "99%", total >= p95, "95%", total >= p75, "75%", 1=1, "0%")
| stats sum(total) as "Totals" by Percentile
| rename Totals as "Total Transactions"

 

however this is now only showing the 99% and not 75% or 99%.

 

Any thoughts?

 

Thanks

 

Joe

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have not included _time in the stats so you will get a single result

joe06031990
Communicator

It also looks like it is just selecting the first Percentile in the case statement no matter what it is.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...