Deployment Architecture
Highlighted

Bin bucket to start with event value

New Member

Hi All,

I am using bin command to bucket all the event count based on a span of 200. The command I used is

{my search query} | bin duration span=200 | stats count by duration

Here when I try to execute this, even though the duration starts with a value for eg: 310, I see the bins are shown as 200-400, 400-600 but I wanted the bin to display from my duration start value with a span of 200 like - 310-509, 510-709, 710-909 etc. Is it possible to achieve this?

0 Karma
Highlighted

Re: Bin bucket to start with event value

New Member

Could someone please help with this?

0 Karma
Highlighted

Re: Bin bucket to start with event value

Motivator

I'm thought of this a long time. I've achieved similar thing but this one is really difficult to implement logic. I'm guessing if some-else have some idea about it to achieve.

0 Karma
Highlighted

Re: Bin bucket to start with event value

New Member

Thanks for the comment. I would really appreciate if someone could point to some direction on how to achieve this.

0 Karma
Highlighted

Re: Bin bucket to start with event value

SplunkTrust
SplunkTrust

@lakssiv not sure this will satisfy, what i got is very clumsy use of bin
but i am using functions that apply only on _time field to get achieve your requirements:
try this anywhere:

  | makeresults count=1
    | eval data = "310,320,500,600,700,800,1009"
    | makemv data delim="," 
    | mvexpand data
    | rename _time as reset_time_later
    | eval _time = data
    | bin _time aligntime=310 span=200 as bin_for_data
    | eval _time = reset_time_later

in a dashboard it will be easier to accomplish as you can set tokens form searches and pass them to the next search with good flexibility.
another option can be the map command
hope it helps a little

0 Karma
Highlighted

Re: Bin bucket to start with event value

SplunkTrust
SplunkTrust

Did you try start=<num> though? It's an option to bin.

0 Karma
Highlighted

Re: Bin bucket to start with event value

SplunkTrust
SplunkTrust

try this:

| makeresults count=1
| eval data = "1,310,320,500,600,700,800,1009"
| makemv data delim="," 
| mvexpand data
| bin data start=310 span=200

maybe i am missing something but using start=<num> didnt work for me

0 Karma
Highlighted

Re: Bin bucket to start with event value

New Member

I tried the start= but that didn't work. I am going to try what adonio suggested, will update here.

0 Karma
Highlighted

Re: Bin bucket to start with event value

New Member

Tried adonio comment but looks like its totally ignoring the start attribute and start the bucket from 0 like 0-200, 200-400, 400-600 etc.

0 Karma