Splunk Search

How do I bin counts per day then show a distribution of count per day?

tpirozzi
Explorer

So if I have over the past 30 days various counts per day I want to display the following in a stats table showing the distribution of counts per bucket. IS this possible?

MY search is this

host="foo*" source="blah" some tag

host [ 0 - 200 ] [201 - 400] [401-600] [601 - 800 ] [801-1000]
X 0 10 15 4 1
Y 1 9 13 6 1
Z 5 6 10 5 4

Thanks in advance!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for something like this:

... | bin span=1d _time | stats count as temp by _time host
    | bin span=200 temp | chart count by host temp

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for something like this:

... | bin span=1d _time | stats count as temp by _time host
    | bin span=200 temp | chart count by host temp
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...