How to group multiple methods responsetime into intervals and obtain count?

[Splunk_321]

Hi All,

I have a requirement where I need to group count of methods responsetime into different time intervals.

Below is what I tried 

basesearch 
| eval ResponseTime=if(uri=="/api/auth",null(),responsetime*1000) 
| rex field=gwrequesturi "(?<prefix>\S+)/locations/(?<method>\w+[^/?])" 
| table ResponseTime method

This is resulted in below output

ResponseTime	Method
330	A
1627	B
1025	B
3126	A
2034	B
..........................	...............

I have two possibilities for method (Say for ex: A and B)

I want to get results something like below (Responsetime and count of each method falling in that interval)

ResponseTime	A	B
<=1000	4	8
>1000 and <=3000	11	25
>3000 and <=5000	35	23
>5000	2	4

Can someone help me with the query! 

Thanks in advance!

[VatsalJagani · Accepted solution]

@Splunk_321 - try below search:

basesearch 
| eval ResponseTime=if(uri=="/api/auth",null(),responsetime*1000) 
| rex field=gwrequesturi "(?<prefix>\S+)/locations/(?<method>\w+[^/?])" 
| table ResponseTime method

| eval category=case(ResponseTime<=1000,"<=1000", ResponseTime<=3000,">1000 and <=3000", ResponseTime<=5000,">3000 and <=5000", ResponseTime>5000,">5000")
| chart count over category by Method

 I hope this helps!!! Kindly upvote if it does!!!

[Splunk_321]

This helps. Thank you for the solution!