Splunk Search

Percentile total transactions as a percentage of total transactions

joe06031990
Communicator

Hello,

I have the bellow search:

index=test sourcetype=Test

|stats count by _time

|eventstats perc99(count) as p99

|eval Percentile  = case(count >= p99, “99%”)

|stats count by transactions by percentile 

I want to add a column that shows the % of transactions  in the 99% percentile however can’t work out how to do this. Any advice would be greatly appreciated.

 

Thanks

 

Joe

 

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The first part generates some dummy data

| gentimes start=-5 increment=1m | rename starttime as _time | fields - endhuman endtime starthuman | eval count=random() % 100 


| eventstats perc99(count) as p99
| eval qualifying  = case(count <= p99, count)
| eventstats sum(qualifying) as transactions sum(count) as total
| eval percentage=100*transactions/total

 

joe06031990
Communicator

That’s great, thanks for your help. 😀.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...