Splunk Search

Custom Chart/Bucket Span Widths?

acdevlin
Communicator

I'm trying to set up a pie chart displaying the average response time to a particular server. The pie chart should have 3 buckets of varying width, corresponding to the average response:

  • 1st bucket: 0 <= Response Time < 6

  • 2nd bucket: 6 <= Response Time < 24

  • 3rd bucket: Response Time >= 24

I am not sure how to do this in Splunk; span seems to only take fixed values in determining bucket widths. I've currently just been using chart with span=6, but it would be a huge advantage to split up the data into the 3 buckets described above.

Any help would be much appreciated.

Tags (2)
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

you can try to use the rangemap command to do what you want

.... | rangemap field=ResponseTime low=0-6, middle=6-24, default=high | stats count BY range

and then display the results as a pie chart

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

you can try to use the rangemap command to do what you want

.... | rangemap field=ResponseTime low=0-6, middle=6-24, default=high | stats count BY range

and then display the results as a pie chart

acdevlin
Communicator

Perfect! Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...