I am trying to get the Perc99 and Perc95 from the total transaction in IIS which the bellow search:
source="C:\\inetpub\\logs\\LogFiles\\*" host="WIN-699VGN4SK4U" index="main" |bucket span=1w _time|stats count by _time|eventstats perc95(count) as p95 ,perc95(count) as p95
however it is just being the total for both, any help would be greatly appreciated.
Hi @joe06031990 ,
You had a typo in your example, duplicating the P95 instead of P99.
Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:
| stats count perc95(count) as p95 perc99(count) as p99 by _time
View solution in original post
You're welcome !
Thanks for your help.