Deployment Architecture

How to divide field values into groups depending on a different field?

nikita012
New Member

I have 2 fields.

**Store Minutes**
81145 22
81234 31
81145 38
87654 35
81234 22
81145 10
87654 13

The data should be divided in two buckets. The first bucket contains number of times when Minutes was less than 20. The other bucket contains number of times when Minutes was between 20 and 40 as shown below.

I want the data to be divided in the below format.

Store Bucket1 Bucket2
81145 1 2
81234 0  2
87654 1  1

Can you please provide code for the same.

0 Karma

adonio
Ultra Champion

here is another version using the bin command
it can scale if for example you have values above 40

  | makeresults 
    | eval _raw="Store Minutes
     81145 22
     81234 31
     81145 38
     87654 35
     81234 22
     81145 10
     87654 13
     81145 22
     81234 11
     81145 28
     87654 38
     81234 72
     81145 70
     87654 53" 
    | multikv 
    | table Store Minutes 
    | bin Minutes span=20 as bucket
    | chart count over Store by bucket

hope it helps

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hello @nikita012,

Try this query:

| stats list(Minutes) as Minutes by Store
| eval bucket1=mvfilter(Minutes<=20)
| eval bucket2=mvfilter(Minutes>20 AND Minutes<40)
| eval bucket1=mvcount(bucket1)
| eval bucket2=mvcount(bucket2)
| fillnull bucket1,bucket2 value=0
| table Store, bucket1, bucket2
0 Karma

renjith_nair
Legend

@nikita012 ,

Try

your base search |stats count(eval(Minutes<20)) as Bucket1,count(eval(Minutes>20)) as Bucket2 by Store
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@nikita012

Can you please try this?

YOUR_SEARCH | eval Bucket=case(Minutes<20,"Bucket1",Minutes<40,"Bucket2") | chart count over Store by Bucket

Sample search:

| makeresults | eval _raw="Store Minutes
81145 22
81234 31
81145 38
87654 35
81234 22
81145 10
87654 13" | multikv | table Store Minutes | eval Bucket=case(Minutes<20,"Bucket1",Minutes<40,"Bucket2") | chart count over Store by Bucket

Thanks

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...