Splunk Search

percentile 99th count

joe06031990
Communicator

Hi,

I'm trying to build a search to find the count, min,max and Avg within the 99th percentile, all work apart from the count, not sure if I am missing something:

index="main" source="C:\\inetpub\\logs\\LogFiles\\*" |bin span=1d _time | eval ResponseTime= time_taken/1000000
| eval responseTime= time_taken/1000000
| timechart span=1mon p99(responseTime) as 99thPercentile
| stats min(99thPercentile) as p99responseTimemin max(99thPercentile) as p99responseTimemax avg(99thPercentile) as p99responseTimeavg count(99thPercentile) by _time

 

Thanks

 

Joe

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

@joe06031990 

You've got two timespans in your search, but only one is being used, i.e. the 1mon. I assume you are trying to get the daily 99th percentile and then get the min/avg/max/count over the month.

This will do that

index="main" source="C:\\inetpub\\logs\\LogFiles\\*" 
| eval responseTime= time_taken/1000000
| timechart span=1d p99(responseTime) as 99thPercentile count
| bin span=1mon _time
| stats min(99thPercentile) as p99responseTimemin max(99thPercentile) as p99responseTimemax avg(99thPercentile) as p99responseTimeavg sum(count) as count by _time

 this assumes

  • the count you are looking for is the count of events across the month
  • the month is by calendar month, i.e. if you run a 30 day search on 11th October, you will get the monthly figures from September 12 in a September summary and the monthly figures for October based on the first 11 days October.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@joe06031990 

You've got two timespans in your search, but only one is being used, i.e. the 1mon. I assume you are trying to get the daily 99th percentile and then get the min/avg/max/count over the month.

This will do that

index="main" source="C:\\inetpub\\logs\\LogFiles\\*" 
| eval responseTime= time_taken/1000000
| timechart span=1d p99(responseTime) as 99thPercentile count
| bin span=1mon _time
| stats min(99thPercentile) as p99responseTimemin max(99thPercentile) as p99responseTimemax avg(99thPercentile) as p99responseTimeavg sum(count) as count by _time

 this assumes

  • the count you are looking for is the count of events across the month
  • the month is by calendar month, i.e. if you run a 30 day search on 11th October, you will get the monthly figures from September 12 in a September summary and the monthly figures for October based on the first 11 days October.

 

PickleRick
SplunkTrust
SplunkTrust

No, mate, that's overcomplicating things.

You don't normally use timechart with bin. That's what timechart is for. So | bin | timechart is kinda pointless.

If you want to do a monthly max/avg/whatever of daily values, it's enough to do

<your search> | timechart span=1d whatever_stats_you_want
| timechart span=1m whatever_stats_you_want
0 Karma

joe06031990
Communicator

Thanks for your help.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not fully sure what you're trying to achieve but | timechart | stats by _time is almost surely not the way to go. With timechart you calculate some stats values and spread them over points in time then in stats by _time you're trying to calculate stats from single values (for each of those time points).

So I suppose you're getting 1 as count. And it's pretty understandable. And all the other stats also don't make much sense because avg() from one value is just this value. Same for other stat functions.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...