topic Re: Group results by range values in Splunk Search

Group results by range values

tyronetv — Tue, 22 Jan 2013 17:02:48 GMT

I'm sure there is probably an answer this in the splunk base but I am having issues with what I want to call what I am attempting to do so therefore searching on it is somewhat difficult. 🙂

Essentially I want to pull all the duration values for a process that executes multiple times a day and group it based upon performance falling withing multiple windows. I.e. "Fastest" would be duration < 5 seconds. "Fast" would be duration 5 seconds or more but less than, say, 20. "Slow" would be anything 20 seconds or longer but less than, say, a minute, or 60 seconds, and "Painful" would be anything 60 seconds or longer.

Ideas?

Re: Group results by range values

jonuwz — Tue, 22 Jan 2013 17:29:23 GMT

Something like this (assuming the field your interested in is called 'dur') :

<your search here> 
| eval speed=case(dur<5,"Fastest",dur<20,"Fast",dur<60,"Slow",1=1,"Painful)
| stats count by speed

The case statement exits on the 1st match, so the last statement :

1=1,"Painful"

acts as a default

Re: Group results by range values

martin_mueller — Tue, 22 Jan 2013 18:43:04 GMT

Rangemap? 🙂

Re: Group results by range values

the_wolverine — Tue, 22 Jan 2013 20:16:32 GMT

search | rangemap field=duration Slowest=0-5 Slow=5-27 Fast=27-500 Fastest=500-10000

Re: Group results by range values

martin_mueller — Wed, 23 Jan 2013 07:50:23 GMT

I believe it's the other way round, low durations are fastest

Re: Group results by range values

moisesroth — Mon, 28 May 2018 12:33:45 GMT

Another solution is to group by range, e.g:
search | chart count by duration span=5