Reporting

In pivot report setup, can the range size vary?

kbrossard
Engager

I'm creating a response time report via a column chart with ranges. Response times are in milliseconds. Is it possible to override the single "range size" that would be applied across the max number of ranges with an increasing range size? For example
Range 1: 0-100 MS ( range size of 100 )
Range 2: 101-500 MS ( range size of 400 )
Range 3: 501-1000 MS ( range size of 500 )
Range 4: 1001-2000 MS ( range size of 1000 )
Range 5: 2001+ MS

Thanks

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You can create a calculated field to hold your ranges:

| eval myRange=case(responsetime<=100,1, responsetime<=500,2, responsetime<=1000,3, responsetime<=2000,4, true(),5)

You could also give more descriptive names, as long as you make sure they will sort as desired...

| eval myRange=case(responsetime<=100,"Range 1: 0-100 MS", responsetime<=500,"Range 2: 101-500 MS", ...etc...)

kbrossard
Engager

How do i add that "eval" logic to the existing pivot command?

When I open the saved report in pivot, select edit in pivot then open in search this is what I currently have:

| pivot apiUpdateResponseTimeReport RootObject count(RootObject) AS "Transaction Counts" SPLITROW responseTimeMS AS "API Add/Update/Delete response times in millseconds" RANGE max=5 SPLITCOL apiType SORT 100 responseTimeMS ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 1

I've tried manipulating this just about every way to incorporate the eval command of " | eval myRange=case(responsetime<=100,1, responsetime<=500,2, responsetime<=1000,3, responsetime<=2000,4, true(),5) " but I think I'm a little of base with my approach ( still learning as I go ).

Thanks for the assistance.

-Kenny

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@kbrossard - That eval is streamable, and you'd just build it into the data model definition itself at the deepest level that you'd need to use it. Presumably, responseTimeMS is built into your RootObject, and it doesn't look like you have any intermediate levels, so I'd be looking to put the new field in there. All the places that responseTimeMS is in the pivot language, you'd use the new field name, and adjust the sort and numcols accordingly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...