topic Re: Bucket/Group results in Deployment Architecture

Bucket/Group results

gogetsplunk — Mon, 28 Sep 2020 09:54:28 GMT

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | stats avg(US) as AverageResponseTime by host

Is there a way to bucket AverageResponseTime above in buckets of 100ms?

Re: Bucket/Group results

sideview — Fri, 23 Sep 2011 18:43:57 GMT

yep

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | stats avg(US) as AverageResponseTime by host | bucket AverageResponseTime span=100

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bucket

UPDATE---------------------------

well, if the US field is a number of milliseconds already then the bucket span is correct. If the US field is a number of seconds then you'll want to use span="0.1" instead.

As for the overall report, this does pretty much what you asked for. Granted you'll probably want to end up with a | sort AverageResponseTime on the end.

With that search you'll end up with a table where each row is a host, and the AverageResponseTime field will be things like "0.2-0.3", "0.3-0.4".

As a slightly different report, you might be interested in this report which is nicely chartable as a split-by column chart, where the bucketed response time intervals are on the x-axis and it's a frequency chart split by host...

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | bucket AverageResponseTime span="100" | chart count over AverageResponseTime by host

Re: Bucket/Group results

sf-mike — Mon, 28 Sep 2020 12:16:57 GMT

the below answer is incorrect. Here is the correct syntax:

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | bucket _time span=100ms | stats avg(US)as AverageResponseTime by _time host

Re: Bucket/Group results

sideview — Thu, 16 Aug 2012 22:46:27 GMT

Note that his question doesn't have to do with the _time field, but with the US field. So bucketing by time isn't what was asked for. I've updated my answer below and I still believe it's at least close to what they're looking for.