Reporting

Is it possible to get percentiles in pivots?

therockhead
Path Finder

Hi,

I'm attempting to port over some searches to pivots and data models for performance reasons. One issue I'm seeing is getting the percentiles. For example the old search may have something like

| stats perc25(Duration) AS "25th Percentile", median(Duration) AS "Median", perc75(Duration) AS "75th Percentile", perc95(Duration) AS "95th Percentile" 

Is this possible in pivots?

Thanks,
Bill

Tags (2)

tpflicke
Path Finder

The pivot command currently (v6.2.1) support the median but not other percentiles.
However, if you simply want to have the reports using datamodel acceleration rather than the drag and drop features of the pivot UI the you could use tstats. The tstats command will use the tsidx files of your accellerated datamodel and you can use perc, exactperc and upperperc.

| tstats p25(Duration) AS p25 p50(Duration) AS p50 p75(Duration) AS p75 from datamodel=SomeDataModel

BTW, for something more complex you might create a pivot via the UI, run it and inspect the job which gives you the tstats command which you can then modify / develop further.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...