topic Re: How does the bucket command create bins? in Splunk Search

How does the bucket command create bins?

chris — Fri, 28 Feb 2014 21:33:51 GMT

I thought that the bucket command would split events into two bins that cover half the search span if i use 2 bins on _time:

index=_internal | bucket _time bins=2 | stats count by _time

Depending on the selected time range bucket will only create 1 bin. This search yields the results I expect:

index=_internal | addinfo | eval half_span=(info_max_time-info_min_time)/2 | eval cur=if(_time>info_max_time-half_span,1,0) | stats count by cur | sort -cur

Can someone explain how bucket is used properly?

Thanks
Chris

Re: How does the bucket command create bins?

somesoni2 — Fri, 28 Feb 2014 21:46:50 GMT

The 'bins' option in bucket specifies maximum no of bins that can be created, doesn't imply that search will create two bins only. bucket command is not suitable for your requirements as your time range can be dynamic.

Re: How does the bucket command create bins?

chris — Fri, 28 Feb 2014 22:02:34 GMT

Thank you, reading the documentation would have helped - well maybe this is useful for someone else.