Why does the bucket command show 3 rows when bin=4, but 1 row when bin=3?

[pramit46]

when I use the following:

index= _internal  | bucket size bins=3 |stats count(_raw) by size

I see:
size-----------count(_raw)
0-100000000-------------7

But if use:

index= _internal  | bucket size bins=4 |stats count(_raw) by size

I see:
size---------------count(_raw)
0-10000000--------------4
20000000-30000000---2
30000000-40000000---1

Should it not also show 3 rows when bin number was set to 3?

[stephanefotso · Accepted solution]

Hello! Bucket/bins does not means number of rows, but it means number of rows if possible. When you say: index= _internal | bucket size bins=3 |stats count(_raw) by size it just means: Bucket search results into 3bins, and return the count of raw events for each bucket. Depending of your time range,and the number of events, you could get 0,1, 2, or 3 rows max, not 4.

Thanks

[pramit46]

Thanks for the clarification @stephanefotso
One small confusion, does it mean that it may or may not put the data in all the buckets? I mean will it always put the data in 3 bins or only 1 bin sometimes?

[stephanefotso]

Here is the description of bucket according to the manual:

Puts continuous numerical values in fields into discrete sets, or buckets, by adjusting the value of field so that all items in a particular set have the same value.

It just means that, it may put the data in all the buckets if values of data returned by the search, allow him to do so. If not, it will return less than the number of buckets you have precised.
Thanks

[pramit46]

🙂
"so that all items in a particular set have the same value." this clears everything..
Thanks