0

So I have log messages containing fields like:

numberOfPlayers: 50
team: Alice
numberOfPlayers: 60
team: Alice
numberOfPlayers: 70
team: Bob
numberOfPlayers: 40
team: Bob

I want to get 99th percentile across largest numberOfPlayers in a team, basically I want to get p99(bob team's largest numberOfPlayers, alice team's largest numberOfPlayers, ....)

I've written this log insight query to successfully get largest numberOfPlayers across all unique teams as an alias called largeset:

fields @log
| pct(numberOfPlayers, 100) as largest group by team 

So results became:

largeset       team
60             Alice
70             Bob

But when I tried to get p99 percentile on the alias largest like this:

fields @log
| pct(numberOfPlayers, 100) as largest group by team 
| pct(largest, 99)

It won't let me to do so, syntax error.

Is it possible to do such pct() on an alias? If not, how should I write the query to get this single value of p99?

OEurix
  • 393
  • 4
  • 19

0 Answers0