percentile total transactions in IIS

[joe06031990]

Hello,

I am trying to get the Perc99 and Perc95 from the total transaction in IIS which the bellow search:

source="C:\\inetpub\\logs\\LogFiles\\*" host="WIN-699VGN4SK4U" index="main" |bucket span=1w _time|stats count by _time|eventstats perc95(count) as p95 ,perc95(count) as p95 

however it is just being the total for both, any help would be greatly appreciated.

Thanks

Joe

[efika]

You're welcome !

[efika · Accepted solution]

Hi @joe06031990 ,

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

[joe06031990]

Thanks for your help.