https://community.splunk.com/t5/Splunk-Search/Custom-Chart-Bucket-Span-Widths/m-p/52299#M12696 <P>I'm trying to set up a pie chart displaying the average response time to a particular server. The pie chart should have 3 buckets of varying width, corresponding to the average response:</P> <UL> <LI><P>1st bucket: 0 &lt;= Response Time &lt; 6</P></LI> <LI><P>2nd bucket: 6 &lt;= Response Time &lt; 24</P></LI> <LI><P>3rd bucket: Response Time &gt;= 24</P></LI> </UL> <P>I am not sure how to do this in Splunk; span seems to only take fixed values in determining bucket widths. I've currently just been using <CODE>chart</CODE> with <CODE>span=6</CODE>, but it would be a huge advantage to split up the data into the 3 buckets described above.</P> <P>Any help would be much appreciated.</P> Tue, 02 Aug 2011 19:08:18 GMT acdevlin 2011-08-02T19:08:18Z https://community.splunk.com/t5/Splunk-Search/Custom-Chart-Bucket-Span-Widths/m-p/52299#M12696 <P>I'm trying to set up a pie chart displaying the average response time to a particular server. The pie chart should have 3 buckets of varying width, corresponding to the average response:</P> <UL> <LI><P>1st bucket: 0 &lt;= Response Time &lt; 6</P></LI> <LI><P>2nd bucket: 6 &lt;= Response Time &lt; 24</P></LI> <LI><P>3rd bucket: Response Time &gt;= 24</P></LI> </UL> <P>I am not sure how to do this in Splunk; span seems to only take fixed values in determining bucket widths. I've currently just been using <CODE>chart</CODE> with <CODE>span=6</CODE>, but it would be a huge advantage to split up the data into the 3 buckets described above.</P> <P>Any help would be much appreciated.</P> Tue, 02 Aug 2011 19:08:18 GMT https://community.splunk.com/t5/Splunk-Search/Custom-Chart-Bucket-Span-Widths/m-p/52299#M12696 acdevlin 2011-08-02T19:08:18Z https://community.splunk.com/t5/Splunk-Search/Custom-Chart-Bucket-Span-Widths/m-p/52300#M12697 <P>you can try to use the rangemap command to do what you want</P> <PRE><CODE>.... | rangemap field=ResponseTime low=0-6, middle=6-24, default=high | stats count BY range </CODE></PRE> <P>and then display the results as a pie chart</P> Wed, 03 Aug 2011 01:33:08 GMT https://community.splunk.com/t5/Splunk-Search/Custom-Chart-Bucket-Span-Widths/m-p/52300#M12697 Ledion_Bitincka 2011-08-03T01:33:08Z https://community.splunk.com/t5/Splunk-Search/Custom-Chart-Bucket-Span-Widths/m-p/52301#M12698 <P>Perfect! Thank you very much.</P> Wed, 03 Aug 2011 16:44:50 GMT https://community.splunk.com/t5/Splunk-Search/Custom-Chart-Bucket-Span-Widths/m-p/52301#M12698 acdevlin 2011-08-03T16:44:50Z