Getting Data In

What is a "status bucket"?

New Member

In the POST search/jobs endpoint, there's an option to specify a number of status buckets.

It seems that certain information about the search job is only available when this value is greater than 0
(ie search/jobs/{searchid}/summary, search/jobs/{searchid}/timeline),
but it's not clear to mean what exactly is a "status bucket"- and how to determine an appropriate number of status buckets?

0 Karma

SplunkTrust
SplunkTrust
0 Karma

New Member

Thank you, that helps somewhat. Just to make sure my understanding is now correct:

status_buckets is an integer that tells Splunk how many timebuckets it should keep for summary statistics about the extracted fields

Looking through docs, it seems that "time buckets" refers to a number of buckets that each span some time interval, used with certain timeline related commands (ie tstats). Is that the same definition of timebuckets as the one in the quoted portion?

It then proceeds to keep 2 buckets of summary statistics, for all the fields referenced in the search, plus the field "username".

So if statusbuckets had been set to 1, or even 10, how would that have affected this output? Based on the above definition of time buckets, I understand that this means the granularity of summary statistics would have been broken down into multiple intervals (ie if statusbuckets was 10 and the search time range was 10 hours, there would be 10 hour-long buckets generated)?

0 Karma