Splunk Search

Calculate percentile by fieldname

jpedrofs
New Member

I have my events in the following format:

{
    "a": {
       "b": {
          "c1": {
             "d1": value1
             "d2": value2
              }
          "c2": {
             "d1": value1
             "d2": value2
              }
           }
       }
}

I am trying to calculate the 50th percentile of value1 grouped by c1, c2, etc.

I tried the following, but it does not work.

| stats perc50(a.b.*.d1) by a.b.*

Do I need to use regex for this?

Tags (3)
0 Karma

stephane_cyrill
Builder

HI jpedrofs,
1-The function perc50( ) works on a field of numerical values.
for example if Y is a field with the following values 10,9,8,7,6,5,4,3,2,1

perc50(Y) =6

2-As i'm seeing your data if a ,b ,c........are integers then you have to extract each set an put them in filds.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...