topic Re: Get bucket IDs corresponding to events in Getting Data In

Get bucket IDs corresponding to events

Marklar — Sat, 01 Jan 2011 10:59:21 GMT

How can I find the corresponding bucket IDs for specific events in an index?

Re: Get bucket IDs corresponding to events

Marklar — Sat, 01 Jan 2011 11:03:27 GMT

You can use the _cd field, which contains "bucket_id:event_offset" for that particular event.

I used the following search to find which buckets my events were going into:

index=myindex | eval BID = replace(_cd, "(\d+):\d+", "\1") | top BID

Remember that bucket IDs only have meaning within that index, not across them. You could easily do things like filter by timerange:

index=myindex _time>=1234567890 _time<=1234567899| eval BID = replace(_cd, "(\d+):\d+", "\1") | top BID

Re: Get bucket IDs corresponding to events

marcoscala — Mon, 20 Oct 2014 15:07:21 GMT

Take care! the rex in the "replace" commando is wrong because the backslash before "d+" and before "1" is truncated by this editor!!!

Il should be
index=myindex | eval BID = replace(_cd, "('backslash'd+):'backslash'd+", "'backslash'1") | top BID

Marco

Re: Get bucket IDs corresponding to events

bandit — Tue, 24 Mar 2015 21:08:34 GMT

Thanks. I ended up with a search like this:

my search here | eval bucket_event_id=_cd | rex field=bucket_event_id "(?<bucket_id>[^:]+):" | stats count by index sourcetype splunk_server bucket_id | sort splunk_server bucket_id

Re: Get bucket IDs corresponding to events

bbialek — Wed, 22 Jun 2016 19:49:50 GMT

On Splunk 6.4, _cd doesn't seem to be a field... Does anyone know how to identify which bucket an even is in on the newer versions?