Splunk Search

percentile total transactions in IIS

joe06031990
Path Finder

Hello,

I am trying to get the Perc99 and Perc95 from the total transaction in IIS which the bellow search:

 

source="C:\\inetpub\\logs\\LogFiles\\*" host="WIN-699VGN4SK4U" index="main" |bucket span=1w _time|stats count by _time|eventstats perc95(count) as p95 ,perc95(count) as p95 

 

however it is just being the total for both, any help would be greatly appreciated.

 

Thanks

 

Joe

 

Labels (3)
0 Karma
1 Solution

efika
Communicator

Hi @joe06031990 ,

 

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

View solution in original post

efika
Communicator

You're welcome !

0 Karma

efika
Communicator

Hi @joe06031990 ,

 

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

View solution in original post

joe06031990
Path Finder

Thanks for your help.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!