I find doing eventstats on raw data to be tremendously slow. I'd probably compute the percentile in a subsearch and pass it through. Then you only do the percentile computation once. index=xyz status=complete [ search index=xyz status=complete | stats p95(dur) as p95Dur | eval search = "dur>"+p95Dur | table search] ... View more