after applying count by _timeslice, can I apply pct on _count?

Follow

Heng Zhang

• June 21, 2020 00:25

the percentile function (https://help.sumologic.com/05Search/Search-Query-Language/aaGroup/percentile-(pct)) needs to specify a field after by

 

i first use count by _timeslice to get a two column table : Time and _count.

now I want to get the percentile of _count, can i do that via sumo query?

0

• 

  Mohit Mehta

  • July 06, 2020 22:29
  • Edited

  Hello Heng,

  I think you can do a percentile of _count. You can try like below syntax:

  | count by _timeslice 
  | pct(_count, 95) as count_95th by _count

  This should work. Let me know if you have any questions or concerns.

  
  Thanks,

  Mohit

  0

  Comment actions Permalink

Please sign in to leave a comment.