topic How to calculate through bin command ? in Splunk Search

How to calculate through bin command ?

Jouman — Wed, 30 Nov 2022 02:25:53 GMT

Hi all,

I would like to use bin command to make the demo data sets into 10 bins according to Exe_time and list Substage_time along with it.
Do anyone have ideas about how to use bin command correctly?

I use these commands, but the output isn't as my expectation.
|bin Exe_time as time_bin bins=10
|stats values(Substage_time) by time_bin

Demo data sets are listed below:

Exe_time	Substage_time	Count
10	8 11	2
21	9 12	2
32	8	1
43	9 19	4
54	9 12	3
65	8 11	6
66	9 19	7
67	8 11	6
70	9 12	6
71	8 11	5
80	7	4
81	9 12	11
95	7	8
108	11	3
220	8 11	5

Thank you.

Re: How to calculate through bin command ?

ITWhisperer — Wed, 30 Nov 2022 08:58:00 GMT

The format of the bin command you have used is correct.

How is the result not matching your expectation?

What is it you are trying to do?

Re: How to calculate through bin command ?

Jouman — Mon, 05 Dec 2022 09:44:14 GMT

Hi all,

I use the demo data and the bin commands as below.
I expect to get 5 bins seperately,
1st bin : include 1-4
2nd bin : include 5-8
3rd bin : include 9-12
4th bin : include 13-16
5th bin : include 17-20

But the output bin is only 2, they are 0-10 and 10-20.

--------------------------------------------

Re: How to calculate through bin command ?

ITWhisperer — Mon, 05 Dec 2022 10:18:23 GMT

bins specifies the maximum number of bins. The bin command will not do what you want the way you want it. You could try evaluating a new field with the calculated bin number that you want from the exe_time field.

Re: How to calculate through bin command ?

Jouman — Tue, 06 Dec 2022 07:06:28 GMT

Hi all,

Do you know what is the logic of bin command?

I want to explain why the number of bin is 2 instead of 10.

Thank you.

Re: How to calculate through bin command ?

ITWhisperer — Tue, 06 Dec 2022 08:58:10 GMT

10 is the maximum, not the minimum - 3 does not exceed the 10 so is a valid way of dividing up the values. If you play around with the mock data, you may be able to determine how it decides on the range size for the bins, but I suspect it might go something like this: does range 1 give a maximum of 10 bins? No. OK how about 10? Yes, with range of 10, all the values will fit into no more than 10 bins. Perhaps with more values the next size up would be 100 or perhaps 20. Whatever the range size, you will get no more than 10 bins.

The other way of using bin is to use the span option - for this you could use span=10 which may give you more bins, but the range would be 10.