Splunk Search

percentile total transactions in IIS

joe06031990
Communicator

Hello,

I am trying to get the Perc99 and Perc95 from the total transaction in IIS which the bellow search:

 

source="C:\\inetpub\\logs\\LogFiles\\*" host="WIN-699VGN4SK4U" index="main" |bucket span=1w _time|stats count by _time|eventstats perc95(count) as p95 ,perc95(count) as p95 

 

however it is just being the total for both, any help would be greatly appreciated.

 

Thanks

 

Joe

 

Labels (2)
0 Karma
1 Solution

efika
Communicator

Hi @joe06031990 ,

 

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

View solution in original post

efika
Communicator

You're welcome !

0 Karma

efika
Communicator

Hi @joe06031990 ,

 

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

joe06031990
Communicator

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...