Deployment Architecture

Manually defining bucket range

aaronkorn
Splunk Employee
Splunk Employee

Is there a way to manually define the range of a bucket for a search? For example we would want a bucket for 0-7, 8-15 etc...

Thanks!

0 Karma
1 Solution

BobM
Builder

It may be simpler to use the rangemap command to do this. e.g. The following will set the value range to 1 if the count is between 1 and 100, 2 if it is between 101 and 110, 3 if between 111 and 700, 4 if it is over 700.

* | stats count by host | rangemap field=count 1=1-100 2=101-110 3=111-700 default=4

View solution in original post

BobM
Builder

It may be simpler to use the rangemap command to do this. e.g. The following will set the value range to 1 if the count is between 1 and 100, 2 if it is between 101 and 110, 3 if between 111 and 700, 4 if it is over 700.

* | stats count by host | rangemap field=count 1=1-100 2=101-110 3=111-700 default=4

BobM
Builder

you can also use this with string bucket such as

| rangemap field=number tiny=0-1 small=1-10 medium=10-100 large=100-10000 default=enormous

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can simply use the eval command's case() function, e.g., ... | eval case(0<=myfield<8,0, 8<=myfield<15, 8, 15<=myfield<100, 15, 100<=myfield,100)

BenjaminWyatt
Communicator

I'm not entirely sure what you're asking. You can set the bucket width quite easily as follows:

MySearchTerms | bucket MyField span=foo

Is this what you are looking to do? It appears to match the criteria you have given above, but I didn't know if you were looking to do something complex (for example, make buckets of different sizes, such as 0-10,10-30,30-60, etc.)

aaronkorn
Splunk Employee
Splunk Employee

Yes I am looking to make buckets of different sizes.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...