Splunk Search

percentile total transactions in IIS

joe06031990
Communicator

Hello,

I am trying to get the Perc99 and Perc95 from the total transaction in IIS which the bellow search:

 

source="C:\\inetpub\\logs\\LogFiles\\*" host="WIN-699VGN4SK4U" index="main" |bucket span=1w _time|stats count by _time|eventstats perc95(count) as p95 ,perc95(count) as p95 

 

however it is just being the total for both, any help would be greatly appreciated.

 

Thanks

 

Joe

 

Labels (3)
0 Karma
1 Solution

efika
Communicator

Hi @joe06031990 ,

 

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

View solution in original post

efika
Communicator

You're welcome !

0 Karma

efika
Communicator

Hi @joe06031990 ,

 

You had a typo in your example, duplicating the P95 instead of P99.

Anyways, you don't need the eventstats, just add the perc95 and perc99 to the stats as follows:

| stats count perc95(count) as p95 perc99(count) as p99 by _time

joe06031990
Communicator

Thanks for your help.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...