Bucket/Group results

[gogetsplunk]

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | stats avg(US) as AverageResponseTime by host

Is there a way to bucket AverageResponseTime above in buckets of 100ms?

[sf-mike]

the below answer is incorrect. Here is the correct syntax:

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | bucket _time span=100ms | stats avg(US)as AverageResponseTime by _time host

[sideview]

Note that his question doesn't have to do with the _time field, but with the US field. So bucketing by time isn't what was asked for. I've updated my answer below and I still believe it's at least close to what they're looking for.

[sideview]

yep

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | stats avg(US) as AverageResponseTime by host | bucket AverageResponseTime span=100

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Bucket

UPDATE---------------------------

well, if the US field is a number of milliseconds already then the bucket span is correct. If the US field is a number of seconds then you'll want to use span="0.1" instead.

As for the overall report, this does pretty much what you asked for. Granted you'll probably want to end up with a | sort AverageResponseTime on the end.

With that search you'll end up with a table where each row is a host, and the AverageResponseTime field will be things like "0.2-0.3", "0.3-0.4".

As a slightly different report, you might be interested in this report which is nicely chartable as a split-by column chart, where the bucketed response time intervals are on the x-axis and it's a frequency chart split by host...

index="abc_prod_apache_access" ST=200 NOT (host="abc-xxx01.xyz.prod") | bucket AverageResponseTime span="100" | chart count over AverageResponseTime by host