topic What syntax can I use to run a search that sorts varying runtimes? in Splunk Search

What syntax can I use to run a search that sorts varying runtimes?

JyotiP — Wed, 23 Aug 2017 12:53:57 GMT

I have data for 1 day where I want to sort it with activity like following manner, total number of records took 0-3 sec , total number of records took 3-4 and goes on. Want to present it in one query.

Re: What syntax can I use to run a search that sorts varying runtimes?

JyotiP — Tue, 29 Sep 2020 15:25:16 GMT

Currently I have separate query as follows :
query 1 : where Val_value>=0 AND Val_value<=3 | stats count
query 2 : where Val_value>=3.1 AND Val_value<=4 | stats count
query 3 : where Val_value>=4.1 AND Val_value<=5 | stats count
query 4 : where Val_value>=5.1 AND Val_value<=6 | stats count
So I want to merge the above request into 1 query. How to do it ?

Re: What syntax can I use to run a search that sorts varying runtimes?

DalJeanis — Wed, 23 Aug 2017 13:47:03 GMT

There are two basic syntaxes you can use (probably a dozen more, but these two demonstrate the top two in use)

your query here 
| eval mygroup=case(Val_value>=0 AND Val_value<=3,"0.0 to 3.0", 
    Val_value>3 AND Val_value<=4,"3.0+ to 4.0", 
    Val_value>4 AND Val_value<=5,"4.0+ to 5.0", 
    Val_value>5 AND Val_value<=6,"5.0+ to 6.0", 
    true(),"6.0+")

...then your choice of one of these two...

| stats count by mygroup
| chart count by mygroup

stats presents one record per value of mygroup, chart would present them horizontally.

... OR ...

your query here 
| stats count(eval(Val_value>=0 AND Val_value<=3)) as "0.0 to 3.0",
    count(eval(Val_value>3 AND Val_value<=4)) as "3.0+ to 4.0",
    count(eval(Val_value>4 AND Val_value<=5)) as "4.0+ to 5.0",
    count(eval(Val_value>5 AND Val_value<=6)) as "5.0+ to 6.0",
    count(eval(Val_value>6)) as "6.+"

This second version presents them horizontally. If you wanted to change them to vertically, you could do it the other way, or add this afterward...

 | eval junk=1
 | untable junk mygroup count
 | fields - junk

Re: What syntax can I use to run a search that sorts varying runtimes?

JyotiP — Wed, 23 Aug 2017 15:42:10 GMT

@DalJeanis, thanks for the update, let me try and will post my result

Re: What syntax can I use to run a search that sorts varying runtimes?

JyotiP — Tue, 29 Aug 2017 09:09:34 GMT

@DalJeanis can create a pi chart or graph for the above query ??