https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458471#M168103 <P>I figure I can do things like this:</P> <P>index=* ..... | <EM>**eval runtimewithmax=case(runTime &gt; 60, 61, true(), runTime)</EM>* | bucket _time span=1h | bin span=20 runtimewithmax | eval epoachtime=_time | stats count as eventcount by epoachtime, context, sourcetype, gdpr, index, path, runtimewithmax </P> <P>but I was hoping there is a better way.</P> Tue, 29 Sep 2020 20:37:09 GMT dtakacssplunk 2020-09-29T20:37:09Z https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458470#M168102 <P>Hello I want to use bin to categorize my runtimes into specific buckets. lets' say I want to show runtime and bucketize it every hour into buckets 0-20, 20-40, 40-60, 60 - maxtime. How do I do this?</P> <P>Currently my query is like this:<BR /> index=* ..... | bucket _time span=1h | bin span=20 end=200 runTime | eval epoachtime=_time | stats count by epoachtime, runTime | makecontinuous runTime | fillnull count</P> <P>and I get the following result :</P> <P>epoachtime runTime count<BR /> 1532620800 0-20 2263<BR /> 1532624400 0-20 3097<BR /> 1532628000 0-20 2249<BR /> 1532617200 0-20 45<BR /> 1532631600 0-20 1615<BR /> 1532631600 20-40 3<BR /> 1532631600 40-60 1<BR /> 60-80 0<BR /> 80-100 0<BR /> 100-120 0<BR /> 120-140 0<BR /> 140-160 0<BR /> 160-180 0<BR /> 180-200 0<BR /> 200-220 0<BR /> 1532620800 220-240 1<BR /> 1532631600 240-260 2<BR /> 1532620800 260-280 1<BR /> 1532631600 260-280 1</P> Tue, 29 Sep 2020 20:37:06 GMT https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458470#M168102 dtakacssplunk 2020-09-29T20:37:06Z https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458471#M168103 <P>I figure I can do things like this:</P> <P>index=* ..... | <EM>**eval runtimewithmax=case(runTime &gt; 60, 61, true(), runTime)</EM>* | bucket _time span=1h | bin span=20 runtimewithmax | eval epoachtime=_time | stats count as eventcount by epoachtime, context, sourcetype, gdpr, index, path, runtimewithmax </P> <P>but I was hoping there is a better way.</P> Tue, 29 Sep 2020 20:37:09 GMT https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458471#M168103 dtakacssplunk 2020-09-29T20:37:09Z https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458472#M168104 <P>If I understand your question correctly, you want to see events classified by groups of runtimes.</P> <P>You might try the eval case function like<BR /> ... | eval timeBin=case(runTime &lt; 20, "0-20", runTime &lt; 40, "0-40"...</P> <P>This would give you a new field timeBin that would have those string values you could use to group by, etc.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/ConditionalFunctions">http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/ConditionalFunctions</A></P> Thu, 26 Jul 2018 23:34:05 GMT https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458472#M168104 nplamondon 2018-07-26T23:34:05Z https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458473#M168105 <P>yes I was thinking of the solution you proposed, but I wish the bin function min / max arguments somehow could be used to achieve something like it... </P> Thu, 26 Jul 2018 23:38:20 GMT https://community.splunk.com/t5/Splunk-Search/bin-with-specific-buckets/m-p/458473#M168105 dtakacssplunk 2018-07-26T23:38:20Z