Splunk Search
Highlighted

Bucket Listing

New Member

Ok, first off this has nothing to do with the colloquial notion of a 'bucket list'.
What I'm trying to do is to run a query that makes buckets via two text fields: Job and Counter. What I need is basically something like this:

index=main | chart list(value) as values by job,counter

Only instead of a list of all the values, I want to have a list of buckets e.g. something that might look like this:

index=main | chart list(bucket bins=5 value) as values by job,counter

The reason I want to do this is because I need to index these buckets in order to have them quickly available in a reporting chart. How do I do the above operation?

0 Karma
Highlighted

Re: Bucket Listing

Splunk Employee
Splunk Employee
index=main | bucket bins=5 value | chart list(value) as values by job,counter
0 Karma