splunk - 如何在 Splunk 中准确计算第 99.9 个百分位数

Question

有谁知道如何在 Splunk 中准确计算第 99.9 个百分位数？

我尝试了如下多种方法，例如 exactperc(但这只需要整数百分位数)和 perc(但这非常接近结果)。

base | stats exactperc99(latency) as "99th Percentile", p99.9(latency) as "99.9th Percentile"

谢谢，詹姆斯

Answer 1

来自Splunk documentation :

There are three different percentile functions:

perc<X>(Y) (or the abbreviation p<X>(Y)) upperperc<X>(Y)exactperc<X>(Y) Returns the X-th percentile value of the numeric fieldY. Valid values of X are floating point numbers from 1 to 99, such as99.95.

Use the perc<X>(Y) function to calculate an approximate threshold,such that of the values in field Y, X percent fall below thethreshold.

The perc and upperperc functions give approximate values for theinteger percentile requested. The approximation algorithm that isused, which is based on dynamic compression of a radix tree, providesa strict bound of the actual value for any percentile. The percfunction returns a single number that represents the lower end of thatrange. The upperperc function gives the approximate upper bound. Theexactperc function provides the exact value, but will be veryexpensive for high cardinality fields. The exactperc function couldconsume a large amount of memory in the search head.

Processes field values as strings.

例子:

 p99.999(response_ms)
 p99(bytes_received)
 p50(salary) # median