Deployment Architecture

Histogram and bucket size

uthornander_spl
Splunk Employee
Splunk Employee

Hi
I have some proprietary log data that gives 3 different response times for each event.
These are extracted into Timer1,Timer2,Timer3

What I want to achieve is to count the number of timer events that fall into a bucket where i can control the bucket size.

That means that just countingh the number of 0,3 second response time events is not enough, but I also want to control so that it is counted in bucket that holds 0-1 second response times.

As a twist to it, I don't know how many buckets I need, or rather I don't know how long the longest response time is, but I would like to truncated/gather up the values over a certain value..

Then I want to plot the count on the Y axis, and the buckets on the X axis.

I get somewhere by using:

|bin span=1 timer1 as Rtime | chart count as "Count" by Rtime

But then I'm stuck.

UT
0 Karma

kskoeld
New Member

Working on the same problem this did it for me:

timer1="*" 
| bin span=0.01 timer1 as "time in ms" 
| chart count as "count" by "time in ms"

However I can't figure out hot to get the labels for the buckets to be shown on the x-axis:
alt text

What I would expect are the following buckets to be shown on the x-axis:
alt text

If they are missing because there are just to many to be displayed then how can I configure to say only display every 10th or so?

,working on the same problem this did it for me:
timer1="*"
| bin span=0.01 timer1 as "time in ms"
| chart count as "count" by "time in ms"

0 Karma

uthornander_spl
Splunk Employee
Splunk Employee

So how did you get the other timers in (and preferably coded in another color)?

UT
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...