Deployment Architecture
Highlighted

Creating clusters from intervals of numeric values

Path Finder

Hi everyone

I want to create clusters of numeric data.

For example:

field: temperature with values between 19.0°C and 23.0°C

the clusters should be as following:

temp1: 19.0 - 21.0
temp2: 21.1 - 22.0
temp3: 22.1 - 23.0

I would need to have a search string as such: |eval temp1=(temperature>="19.0" AND "temperature<="21.0")

so I can search for | chart list(error) by temp*

in order to see how many times an error occured in each of the temperature intervalls.

Tags (3)
0 Karma
Highlighted

Re: Creating clusters from intervals of numeric values

Motivator

To do a chart that is subdivided by temperature clusters, what you want to do is create one field (let's call it temprange) with different values. That way you can use | stats list(error) by temprange to get what you want.

...your search for data...
| eval temprange=case(temperature>=19 AND temperature<=21,"low",temperature>21 AND temperature<=22,"medium",temperature>22 AND temperature<=23,"high",1=1,"out of range")
| stats list(error) as Errors count by temprange

(Assuming that the temperature field is numeric; you don't want to compare numbers using strings as you've listed above. If not, use the convert function on it: | convert auto(temperature) before doing the eval/case statement.)

View solution in original post

0 Karma
Highlighted

Re: Creating clusters from intervals of numeric values

Path Finder

This is perfect! Thank you 🙂

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.