Percentile

Percentile is an aggregator command that takes a numeric field , such as login_count or session_duration, and a percentile. It collects the values of that field across all log events of your search, and returns the value at the percentile you chose. Percentile provides an investigation threshold by helping you identify unusually high or low values.

For example

Query:

login_count= * | chart percentile(login_count, 99)

Result:

10

Here, the 99th percentile of login_count is 10. This means 99% of observed login_count values are 10 or lower, while approximately 1% exceed 10. That top 1% is worth a closer look, since it could indicate an unusual activity such as a brute-force attempt.