So I have log messages containing fields like:
numberOfPlayers: 50
team: Alice
numberOfPlayers: 60
team: Alice
numberOfPlayers: 70
team: Bob
numberOfPlayers: 40
team: Bob
I want to get 99th percentile across largest numberOfPlayers in a team, basically I want to get p99(bob team's largest numberOfPlayers, alice team's largest numberOfPlayers, ....)
I've written this log insight query to successfully get largest numberOfPlayers across all unique teams as an alias called largeset
:
fields @log
| pct(numberOfPlayers, 100) as largest group by team
So results became:
largeset team
60 Alice
70 Bob
But when I tried to get p99 percentile on the alias largest
like this:
fields @log
| pct(numberOfPlayers, 100) as largest group by team
| pct(largest, 99)
It won't let me to do so, syntax error.
Is it possible to do such pct()
on an alias? If not, how should I write the query to get this single value of p99?