Splunk Search

Insert 90th Percentile as Horizontal Line on Timechart

danielrusso1
Path Finder

New to Splunk, need some help.

I would like to build a timechart that does the following:

  1. Graphs average response over a timeframe in hourly increments
  2. Inserts a horizontal line representing the 90th percentile value for response time over the entire period.

I have the average response time taken care of I think:

| timechart avg(time_taken) span=1h

Any ideas?

Tags (1)
1 Solution

csharp_splunk
Splunk Employee
Splunk Employee

We're having a debate about this on the IRC channel right now. This can be accomplished through a subsearch, which may provide potentially more accurate results, but I think this is just as accurate:

 * | eventstats avg(time_taken) as ttavg | eventstats p90(ttavg) as p90avg | timechart avg(time_taken) max(p90avg)

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

The subsearch approach looks something like this, but it will perform (at least) twice as poorly as csharp's solution -- mainly due to having to run the main search twice. And, it's not been proven to be any more accurate.

_main_search_terms_ | timechart avg(time_taken) as avg 
| appendcols 
    [ _main_search_terms_again_ 
       | stats perc90(gers_SQL_lapse) as p90temp 
       | fields p90temp 
    ] 
| eventstats first(p90temp) as p90 
| fields - p90temp

Unless you can find a demonstrable difference in accuracy, use csharp's solution. We'd be interested to hear results with your data if there is a substantial difference in the results.

0 Karma

csharp_splunk
Splunk Employee
Splunk Employee

We're having a debate about this on the IRC channel right now. This can be accomplished through a subsearch, which may provide potentially more accurate results, but I think this is just as accurate:

 * | eventstats avg(time_taken) as ttavg | eventstats p90(ttavg) as p90avg | timechart avg(time_taken) max(p90avg)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...