topic Re: How to set a standard set for span values in Splunk Search

How to set a standard set for span values

psmp — Thu, 02 Dec 2021 22:15:48 GMT

I have a dhasboard which should show buckets with number of machines by span of time.

Machine A to F is used for 2 mins

Machines D-T was used for 2hrs

Machine s-Z was used for more than 4hrs

So my graph should show the buckets with time range as a standard set.

XAxis

<5 mins,

5-30mins

30min - 2hrs

2-4hrs

> 4hrs

YAxis

No of machines logged on for <2mins

No of machines logged on for 5-30mins

and so on.

Logon Time	Logoff Time	MachineName	SessionTimeinMins
12/1/2021 19:33	12/1/2021 19:36	A	3
12/1/2021 16:46	12/1/2021 17:04	B	18
12/1/2021 15:35	12/1/2021 15:38	C	3
12/1/2021 11:35	12/1/2021 11:38	D	120
12/1/2021 16:35	12/1/2021 21:35	E	300

Base Search | bucket SessionTimeinMins span=20 | chart count(MachineName) by sessionSpan

But this do not help in achieving what i wanted. Any help is much appreciated. Ho do I set my X-Axis to show standard buckets like <2min, 30-1h and bring the count into this bucket.

Thanks

Re: How to set a standard set for span values

ITWhisperer — Thu, 02 Dec 2021 23:01:28 GMT

| eval sessionSpan=case(SessionTimeInMins<5,"5 mins",SessionTimeInMins<30,"5-30mins",SessionTimeInMins<120,"30min - 2hrs",SessionTimeInMins<240,"2-4hrs",1==1,"> 4hrs")

Re: How to set a standard set for span values

psmp — Thu, 02 Dec 2021 23:37:11 GMT

Thank you @ITWhisperer

How can I match the events that fall under this buckets?

like Machine A-X will fall under 5-30min as they all have session times in that timerange.

Thanks for your time and help.

Re: How to set a standard set for span values

ITWhisperer — Thu, 02 Dec 2021 23:43:28 GMT

Do you mean something like this?

| stats values(MachineName) as MachineName by sessionSpan