Answers for "Calculate stats over a percentage of the data"
https://answers.splunk.com/answers/11686/calculate-stats-over-a-percentage-of-the-data.html
The latest answers for the question "Calculate stats over a percentage of the data"Answer by steveyz
https://answers.splunk.com/answering/11780/view.html
<pre><code>sourcetype=wims_auth | stats count as EVNT by APIP MACID | eventstats perc90(EVNT) as cutoff by APIP | where EVNT>=cutoff | stats sum(EVNT) by APIP
</code></pre>Thu, 17 Feb 2011 14:03:08 GMTsteveyz