Sumo's equivalent of Splunk eventstats?


1 comment

  • Official comment
    Ryan Johnson

    Hi Antony,

    This is possible through our join operator, however I believe an equivalent (more elegant) method is in the works. 

    | timeslice 1m
    | count as Count by _timeslice

    // Join current table with pct result
    // Use the venerable `1 as tmp` trick for the join key.
    | join (1 as tmp) as t1,
    (pct(cnt, 97) as k_percentile
    | 1 as tmp) as t2 on t1.tmp = t2.tmp

    // Cleanup fields from join operator.
    | t1__timeslice as _timeslice
    | t1_cnt as cnt
    | t2_k_percentile as k_percentile
    | fields - t1__timeslice, t1_cnt, t1_tmp, t2_k_percentile, t2_tmp

    Feel free to ping me on the Slack channel if you have any further questions!


    Comment actions Permalink

Please sign in to leave a comment.