Splunk Search

Custom Chart/Bucket Span Widths?

acdevlin
Communicator

I'm trying to set up a pie chart displaying the average response time to a particular server. The pie chart should have 3 buckets of varying width, corresponding to the average response:

  • 1st bucket: 0 <= Response Time < 6

  • 2nd bucket: 6 <= Response Time < 24

  • 3rd bucket: Response Time >= 24

I am not sure how to do this in Splunk; span seems to only take fixed values in determining bucket widths. I've currently just been using chart with span=6, but it would be a huge advantage to split up the data into the 3 buckets described above.

Any help would be much appreciated.

Tags (2)
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

you can try to use the rangemap command to do what you want

.... | rangemap field=ResponseTime low=0-6, middle=6-24, default=high | stats count BY range

and then display the results as a pie chart

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

you can try to use the rangemap command to do what you want

.... | rangemap field=ResponseTime low=0-6, middle=6-24, default=high | stats count BY range

and then display the results as a pie chart

View solution in original post

acdevlin
Communicator

Perfect! Thank you very much.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.