Reporting

In pivot report setup, can the range size vary?

kbrossard
Engager

I'm creating a response time report via a column chart with ranges. Response times are in milliseconds. Is it possible to override the single "range size" that would be applied across the max number of ranges with an increasing range size? For example
Range 1: 0-100 MS ( range size of 100 )
Range 2: 101-500 MS ( range size of 400 )
Range 3: 501-1000 MS ( range size of 500 )
Range 4: 1001-2000 MS ( range size of 1000 )
Range 5: 2001+ MS

Thanks

0 Karma

DalJeanis
Legend

You can create a calculated field to hold your ranges:

| eval myRange=case(responsetime<=100,1, responsetime<=500,2, responsetime<=1000,3, responsetime<=2000,4, true(),5)

You could also give more descriptive names, as long as you make sure they will sort as desired...

| eval myRange=case(responsetime<=100,"Range 1: 0-100 MS", responsetime<=500,"Range 2: 101-500 MS", ...etc...)

kbrossard
Engager

How do i add that "eval" logic to the existing pivot command?

When I open the saved report in pivot, select edit in pivot then open in search this is what I currently have:

| pivot apiUpdateResponseTimeReport RootObject count(RootObject) AS "Transaction Counts" SPLITROW responseTimeMS AS "API Add/Update/Delete response times in millseconds" RANGE max=5 SPLITCOL apiType SORT 100 responseTimeMS ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 1

I've tried manipulating this just about every way to incorporate the eval command of " | eval myRange=case(responsetime<=100,1, responsetime<=500,2, responsetime<=1000,3, responsetime<=2000,4, true(),5) " but I think I'm a little of base with my approach ( still learning as I go ).

Thanks for the assistance.

-Kenny

0 Karma

DalJeanis
Legend

@kbrossard - That eval is streamable, and you'd just build it into the data model definition itself at the deepest level that you'd need to use it. Presumably, responseTimeMS is built into your RootObject, and it doesn't look like you have any intermediate levels, so I'd be looking to put the new field in there. All the places that responseTimeMS is in the pivot language, you'd use the new field name, and adjust the sort and numcols accordingly.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...