https://community.splunk.com/t5/Splunk-Search/Bucket-Listing/m-p/18747#M2758 <P>Ok, first off this has nothing to do with the colloquial notion of a 'bucket list'.<BR /> What I'm trying to do is to run a query that makes buckets via two text fields: Job and Counter. What I need is basically something like this:</P> <PRE><CODE>index=main | chart list(value) as values by job,counter </CODE></PRE> <P>Only instead of a list of all the values, I want to have a list of buckets e.g. something that might look like this:</P> <PRE><CODE>index=main | chart list(bucket bins=5 value) as values by job,counter </CODE></PRE> <P>The reason I want to do this is because I need to index these buckets in order to have them quickly available in a reporting chart. How do I do the above operation?</P> Sat, 28 May 2011 02:05:59 GMT deusaquilus 2011-05-28T02:05:59Z https://community.splunk.com/t5/Splunk-Search/Bucket-Listing/m-p/18747#M2758 <P>Ok, first off this has nothing to do with the colloquial notion of a 'bucket list'.<BR /> What I'm trying to do is to run a query that makes buckets via two text fields: Job and Counter. What I need is basically something like this:</P> <PRE><CODE>index=main | chart list(value) as values by job,counter </CODE></PRE> <P>Only instead of a list of all the values, I want to have a list of buckets e.g. something that might look like this:</P> <PRE><CODE>index=main | chart list(bucket bins=5 value) as values by job,counter </CODE></PRE> <P>The reason I want to do this is because I need to index these buckets in order to have them quickly available in a reporting chart. How do I do the above operation?</P> Sat, 28 May 2011 02:05:59 GMT https://community.splunk.com/t5/Splunk-Search/Bucket-Listing/m-p/18747#M2758 deusaquilus 2011-05-28T02:05:59Z https://community.splunk.com/t5/Splunk-Search/Bucket-Listing/m-p/18748#M2759 <PRE><CODE>index=main | bucket bins=5 value | chart list(value) as values by job,counter </CODE></PRE> Sun, 29 May 2011 03:13:03 GMT https://community.splunk.com/t5/Splunk-Search/Bucket-Listing/m-p/18748#M2759 gkanapathy 2011-05-29T03:13:03Z