How do I bin counts per day then show a distribution of count per day?

tpirozzi — Tue, 29 Sep 2020 11:53:48 GMT

So if I have over the past 30 days various counts per day I want to display the following in a stats table showing the distribution of counts per bucket. IS this possible?

MY search is this

host="foo*" source="blah" some tag

host [ 0 - 200 ] [201 - 400] [401-600] [601 - 800 ] [801-1000]
X 0 10 15 4 1
Y 1 9 13 6 1
Z 5 6 10 5 4

Thanks in advance!

Re: How do I bin counts per day then show a distribution of count per day?

martin_mueller — Sat, 19 Nov 2016 13:45:01 GMT

You're probably looking for something like this:

... | bin span=1d _time | stats count as temp by _time host
    | bin span=200 temp | chart count by host temp

topic Re: How do I bin counts per day then show a distribution of count per day? in Splunk Search

How do I bin counts per day then show a distribution of count per day?

Re: How do I bin counts per day then show a distribution of count per day?