topic Auto Group Result in Splunk Search

Auto Group Result

yap — Mon, 28 Sep 2020 13:22:02 GMT

Hi,

I would like to group my product based on weight.

Sample logs are:

Product ID | Weight

00368001a1 | 1.4kg

00368001d1 | 1.3kg

00368002a1 | 0.9kg

00368003a1 | 2.0kg

00368004a1 | 1.5kg

I need to set weight(+ or - between 0.5).
0.5 - 1.4kg as A and 1.5 - 2.4kg is group as B
Instead of manually defining as what I am currently doing:
| eval total_weight=case(weight<0.5,"A",weight<1.4,"B",weight<2.4,"C") | stats count by total_weight
Any help is greatly appreciated.

Re: Auto Group Result

martin_mueller — Thu, 21 Feb 2013 09:27:23 GMT

Bucket with a span of 1 would give you +/-0.5kg values, you just have to strip off the "kg" first to make it numerical. I'm not sure if you can do 0.5-1.5 groups though, it tends to create 0-1 buckets instead. If all else fails, shift your weights up by half a kilo 🙂

Re: Auto Group Result

yap — Thu, 21 Feb 2013 09:35:30 GMT

Thanks Martin