How to compute a new column which is based on the 95th percentile of another column (already computed using Metrics)?

[bouazizrahma]

I'am new in the Elasticstack, can you please help me in the following matter:
I want to compute a new column which is based on the 95th percentiles of another existing column (computed through Metrics).

• The existing column called AccessTime which is the 95th percentiles of the ExecutionTime Field (please refer to screenshot1).

• The new column that I want to compute the NormalizedAccessTime = col['AccessTime] / percentiles95 ['AccessTime']
  (please refer to screenshot2).

Thank you for your help.

[fbaligand]

Hi,

So :

• First, although you configure "AccessTime" in "Custom label" field, the fact is that the real label is "95th percentile of AccessTime".
• In a computed column formula, you can access it either with col2 or col['95th percentile of AccessTime'].
• In your screenshots, I don't see any column with label "AccessTime".
• So you can't have a formula with col['AccessTime] / percentiles95 ['AccessTime']
• If you want to divide one metric by another, I invite you to add another "Metric" aggregation. Maybe "Count" or "Max of AccessTime" or another one. I don't know.
• And once you did it, you could reach your goal with this formula: col3 / col2 or col3 / col['95th percentile of AccessTime']

[bouazizrahma]

Hi @fbaligand,

Thank you very much for your response.

• Yes, you are right, I will use col['95th percentile of AccessTime'] to refer to elements in the column "95th percentile of AccessTime".

• I explain my problem :
  Indeed, in enhanced table computed columns, we can use for example total['95th percentile of AccessTime'] to compute the total of the column "95th percentile of AccessTime".
  My question : Is there any function in expr-eval that allows to compute the 95th percentile of the column "95th percentile of AccessTime" (i.e. like the function total['COLUMN_LABEL']).

Thanks a lot for your help.

Best regards,

[fbaligand]

No such function to my known.
sorry.