Reporting

In pivot report setup, can the range size vary?

kbrossard
Engager

I'm creating a response time report via a column chart with ranges. Response times are in milliseconds. Is it possible to override the single "range size" that would be applied across the max number of ranges with an increasing range size? For example
Range 1: 0-100 MS ( range size of 100 )
Range 2: 101-500 MS ( range size of 400 )
Range 3: 501-1000 MS ( range size of 500 )
Range 4: 1001-2000 MS ( range size of 1000 )
Range 5: 2001+ MS

Thanks

0 Karma

DalJeanis
Legend

You can create a calculated field to hold your ranges:

| eval myRange=case(responsetime<=100,1, responsetime<=500,2, responsetime<=1000,3, responsetime<=2000,4, true(),5)

You could also give more descriptive names, as long as you make sure they will sort as desired...

| eval myRange=case(responsetime<=100,"Range 1: 0-100 MS", responsetime<=500,"Range 2: 101-500 MS", ...etc...)

kbrossard
Engager

How do i add that "eval" logic to the existing pivot command?

When I open the saved report in pivot, select edit in pivot then open in search this is what I currently have:

| pivot apiUpdateResponseTimeReport RootObject count(RootObject) AS "Transaction Counts" SPLITROW responseTimeMS AS "API Add/Update/Delete response times in millseconds" RANGE max=5 SPLITCOL apiType SORT 100 responseTimeMS ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 1

I've tried manipulating this just about every way to incorporate the eval command of " | eval myRange=case(responsetime<=100,1, responsetime<=500,2, responsetime<=1000,3, responsetime<=2000,4, true(),5) " but I think I'm a little of base with my approach ( still learning as I go ).

Thanks for the assistance.

-Kenny

0 Karma

DalJeanis
Legend

@kbrossard - That eval is streamable, and you'd just build it into the data model definition itself at the deepest level that you'd need to use it. Presumably, responseTimeMS is built into your RootObject, and it doesn't look like you have any intermediate levels, so I'd be looking to put the new field in there. All the places that responseTimeMS is in the pivot language, you'd use the new field name, and adjust the sort and numcols accordingly.

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...