topic Re: How to visualize count of messages between .. and .. MB, .. and .. MB etc.? in Splunk Search

How to visualize count of messages between .. and .. MB, .. and .. MB etc.?

svester — Thu, 07 Mar 2019 10:04:28 GMT

Hi,
i want to see how many messages are send, which are between 0 and 1 mb, between 1MB and 2MB, 2 and 3 etc, but I can't even visualize 1 option 😞

I have this: index, host source etc.
| eval if((LENGTH >= 0 AND LENGTH <= 10000000), "Between 0MB en 1MB", "Rest")
| stats count(LENGTH)

Note: LENGTH= shown like this: [LENGTH=365] and is an interesting field (num), shown in bytes.

So i have 2 questions:
- I receive this error with above eval: *Error in 'eval' command: Type checking failed. 'AND' only takes boolean arguments. *
What is wrong with this argument?
- And can someone help me fixing this visualization?

Re: How to visualize count of messages between .. and .. MB, .. and .. MB etc.?

nickhills — Thu, 07 Mar 2019 11:24:53 GMT

The first issue is that your eval syntax is not quite right. Use:

|eval size=if((LENGTH >= 0 AND LENGTH <= 10000000), "Between 0MB en 1MB", "Rest")
| stats count(size)

although case may be a better choice in this scenario.

|eval size=case((LENGTH >= 0 AND LENGTH <= 10000000), "0MB - 1MB", (LENGTH >= 10000001 AND LENGTH <= 20000000), "1MB - 2MB",(LENGTH >= 20000001 AND LENGTH <= 30000000), "2MB - 3MB",1=1, "Bigger")
| stats count(size)

Re: How to visualize count of messages between .. and .. MB, .. and .. MB etc.?

svester — Wed, 13 Mar 2019 12:34:09 GMT

Thanks, I added "by size" to make the visualization better.

 | stats count(size) by size

Re: How to visualize count of messages between .. and .. MB, .. and .. MB etc.?

nickhills — Wed, 13 Mar 2019 15:46:15 GMT

Great, Glad to have helped.