Get bucket IDs corresponding to events

[Marklar]

How can I find the corresponding bucket IDs for specific events in an index?

[bandit]

Thanks. I ended up with a search like this:

my search here | eval bucket_event_id=_cd | rex field=bucket_event_id "(?<bucket_id>[^:]+):" | stats count by index sourcetype splunk_server bucket_id | sort splunk_server bucket_id

[bbialek]

On Splunk 6.4, _cd doesn't seem to be a field... Does anyone know how to identify which bucket an even is in on the newer versions?

[Marklar · Accepted solution]

You can use the _cd field, which contains "bucket_id:event_offset" for that particular event.

I used the following search to find which buckets my events were going into:

index=myindex | eval BID = replace(_cd, "(\d+):\d+", "\1") | top BID

Remember that bucket IDs only have meaning within that index, not across them. You could easily do things like filter by timerange:

index=myindex _time>=1234567890 _time<=1234567899| eval BID = replace(_cd, "(\d+):\d+", "\1") | top BID

[marcoscala]

Take care! the rex in the "replace" commando is wrong because the backslash before "d+" and before "1" is truncated by this editor!!!

Il should be
index=myindex | eval BID = replace(_cd, "('backslash'd+):'backslash'd+", "'backslash'1") | top BID

Marco