Does perc95 require all the raw data for the entire interval?

[ddrillic]

Perc95 is becoming more and more popular with our executives. We wonder whether we need to have all the raw data in order to calculate it.
So, let's say we know what it is for January and next we need to know the value for January and February.
Do we need all the raw data for January and February? or we can somehow capture whatever is needed from January in a summary index and calculate based on that and the raw data for February the value for both months together.

For clarity about the perc95's definition - what does perc95 and all those stats functions perc*

[DavidHourani · Accepted solution]

Hi @ddrillic,

The percX is based on the distribution of your results based on how many times each value appeared. If you save percXfrom January in a summary index for example you won't be able to use it to build the percX over January-February unless you knew the total number of count per value for January.

That being said, if you want to use summary indexing to improve performance for perc90 then you will need to save the count per value per month. With that you can take the count per value for January, February, sum it up and then use the perc90 on it to get the exact results.

Let me know if that helps.

Cheers,
David

[ddrillic]

Very interesting David.

[DavidHourani]

Thanks for accepting ! Happy Splunking 😉