topic Re: using bin command and span in Splunk Search

using bin command and span

jvmerilla — Mon, 11 Dec 2017 06:21:13 GMT

HI,

I have this query:

index="sample_data" sourcetype="management_sampledata.csv" | fields* | search Status!=Closed "Ticket Type"="*" Priority="*" | rename "Reported Date" AS Reported_Date | eval reported_date = strptime(Reported_Date, "%m/%d/%y %H:%M") | eval date_today = now() | eval duration = round((date_today-reported_date)/86400) | bin duration span=30 | chart count as "Open Tickets" by "Support_ Assigned Group", duration

and this is what it shows:

My question is why it returns 180-210 and 210-240? Is it possible that there will be overlaps, like if there's a data with the value of 210, then it will be in both 180-210 and 210-240?

Also is there a way where I can my make it like 180-210, 211-240?

I hope someone can help me with this.

Thank you.

Re: using bin command and span

mayurr98 — Tue, 29 Sep 2020 17:10:57 GMT

Hey @jvmerilla

I have tested this query using test data. There are no overlaps. Your query is perfectly fine.
here the output shows 190-210 which actually means 190-209. So There is no overlap
Also if you have fix columns there you can sort of rename columns by writing | rename 190-210 as 190-209 ..

PFA supporting proofs that there are no overlaps. look for 0-20(total_count) and add all 0-19(count) you will get 457.
date_minute count sum(count)
0 5 5
1 6 11
2 2 13
3 24 37
4 6 43
5 9 52
6 68 120
7 3 123
8 1 124
9 13 137
10 26 163
11 57 220
12 21 241
13 37 278
14 32 310
15 77 387
16 24 411
17 18 429
18 15 444
19 13 457

I hope this helps.

alt text

Re: using bin command and span

jvmerilla — Mon, 11 Dec 2017 10:12:52 GMT

Hi @mayurr98,

I'm sorry but I did not understand. How would I check if there's no overlap?

Re: using bin command and span

mayurr98 — Mon, 11 Dec 2017 11:31:44 GMT

you can look at the count. They are matching. Even you can check this on your data. for 0-19 the count is 457.
so basically even though it is written 0-20 it is basically a sum of 0-19

Re: using bin command and span

jvmerilla — Tue, 12 Dec 2017 08:21:49 GMT

Hi @mayurr98,

It took me a while to figure out what you mean but I get it now. And I already check the data using stats count(eval), and you're right, there's no overlapping. The 180-210 were actually the sum of 180-209.

Thank you for your help. 🙂

Re: using bin command and span

morethanyell — Wed, 20 Jun 2018 09:53:33 GMT

eto yung approach ko dito men
index="excercises" Status!=Closed
| eval rd = strptime(ReportedDate, "%m/%d/%Y %H:%M")
| eventstats max(rd) as MaxDate
| eval age = floor((MaxDate - rd) / 86400)
| bin age span=30
| chart count as "Open Tickets" by SupportAssignedGroup, age
| rename SupportAssignedGroup as "Support Assigned Group"