Splunk Search

How to create a bucket of number of events instead of time?

msyparker
Explorer

Hello! 🙂

I'm tryng to get statistics of groups of 200 events.

For instance, I have the following stats:

|stats sum(CPU) avg(resptime) c as "total"

sum(CPU)----------avg(resptime)----------total
1000-----------------0.00240------------------800

What I wanted to have is:

sum(CPU)----------avg(resptime)----------total
120-------------------0.00125------------------200
300-------------------0.00124------------------200
480-------------------0.00122------------------200
100-------------------0.00122------------------200

OBS. I know how to create bins of time span, but what I need is to make buckets based on event quantity and NOT time.

Thank you in advance!

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | streamstats count AS _serial
| eval _bucketOf200 = floor((_serial - 1)/ 200)
| stats sum(CPU) avg(resptime) count AS total BY _bucketOf200

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

... | streamstats count AS _serial
| eval _bucketOf200 = floor((_serial - 1)/ 200)
| stats sum(CPU) avg(resptime) count AS total BY _bucketOf200
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...