topic How to specify fixed size bucket/bin with stats? in Splunk Search

How to specify fixed size bucket/bin with stats?

howardroark — Tue, 29 Sep 2020 14:43:14 GMT

when I create a stats and try to specify bins by following:
bucket time_taken bins=10 | stats count(_time) as size_a by time_taken

I get different bin sizes when I change the time span from last 7 days to Year to Date.
I am looking for fixed bin sizes of 0-100,100-200,200-300 and so on, irrespective of the data points generated by time.

How can I achieve this?

Any help is appreciated.
Thanks

Re: How to specify fixed size bucket/bin with stats?

somesoni2 — Thu, 06 Jul 2017 15:26:48 GMT

Use span instead of bins option with bucket command, like this

...| bucket span=100 time_taken | stats count as size_a by time_taken | sort num(time_taken)

Re: How to specify fixed size bucket/bin with stats?

DalJeanis — Thu, 06 Jul 2017 15:35:36 GMT

Does bucket sometimes start from odd numbers, like 53-152? I seem to recall having had to add a "zero" record before and delete it after in order to make the numbers be even. Might have been when the range went to negative numbers as well.

Re: How to specify fixed size bucket/bin with stats?

howardroark — Thu, 06 Jul 2017 15:49:00 GMT

@somesoni2 thanks that helped. Though as i change the time the x-axis labels disappear. I dont know how to display permanently

Re: How to specify fixed size bucket/bin with stats?

somesoni2 — Thu, 06 Jul 2017 16:01:35 GMT

The x-axis labels will be visible based on number of points being shown (works good if number of points are under 100 or 74 from what I recall). so check how many rows your stats is giving back, may be adjust your span accordingly.

@Daljeanis, I guess the bucketing works good if they are standard spans like 10, 5, 20, 100. I tested with this runanywhere sample and it seems to be consistent with "good" spans.

| gentimes start=-1000 | streamstats count as sno | where sno>3| bucket span=10 sno | stats count by sno | sort num(sno)

Re: How to specify fixed size bucket/bin with stats?

howardroark — Thu, 06 Jul 2017 16:59:11 GMT

@somesoni2 can we not limit the axis range 0-100 to the last data point 1000-1100. Just show end buckets and skip the rest of them to make it look sensible

Re: How to specify fixed size bucket/bin with stats?

somesoni2 — Thu, 06 Jul 2017 18:28:08 GMT

You can specify how many records you want to keep by either specifying limit in your sort command OR using head command, like this (for sort without by clause):

current command including stats | sort 100 num(sno)

current command including stats | sort num(sno) | head 100

Re: How to specify fixed size bucket/bin with stats?

howardroark — Thu, 06 Jul 2017 18:51:28 GMT

This would provide me with top 100 values. I am looking for all the values but custom x-axis label to atleast get some context of presented data. Like getting first and last bin on the x-axis label

Re: How to specify fixed size bucket/bin with stats?

somesoni2 — Thu, 06 Jul 2017 18:55:54 GMT

AFAIK, no such option exists.