I have a requirement to pull 90% of max execution time.
Ex: I have 10 requests for an hour and it's execution times as below. Out of which if I take max(Executation_time) I will get 10 sec but I want to give 10% leverage and consider max Time from 90% of ExecutionTimes.
I will be getting total number of executation details(10 in this ex) through a seach like `stats count(_raw) by Hour'. Now I have to take 10% record counts and neglect those number of records to get 90% of max Time
Not sure how to interpret "take 10% record counts and neglect those number of records to get 90% of max Time." So, I have make a blind guess: you want to count events whose Execution_Time is above 90% of maximum time. If so, eventstats is your friend.
| eventstats max(Execution_Time) as maxtime ``` max over entire search period ```
| where Execution_Time > 0.9 * maxtime
| stats count by Hour ``` assuming a field named Hour exists ```