- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vijkuma
Engager
12-08-2020
03:52 AM
My Query : --- | stats count by "response time" | rename "response time" as "time_taken" | rangemap field=time_taken upto_5_sec=0-5000 default=more_then_5_sec | stats sum(count) by range
How can i get this result distributed on daily basis.
Current result :
upto_5_sec | 100 |
more_then_5_sec | 1 |
Expected result :
2020-12-05 | upto_5_sec | 80 |
more_then_5_sec | 0 | |
2020-12-06 | upto_5_sec | 20 |
more_then_5_sec | 1 |
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
scelikok

SplunkTrust
12-08-2020
04:06 AM
@vijkuma , please try below;
| stats count by "response time" _time
| rename "response time" as "time_taken"
| rangemap field=time_taken upto_5_sec=0-5000 default=more_then_5_sec
| bin span=1d _time
| stats sum(count) as count by _time range
| stats list(range) as range list(count) as count by _time
If this reply helps you an upvote and "Accept as Solution" is appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vijkuma
Engager
12-08-2020
10:21 PM
This worked. @scelikok Thanks for the help. Much appreciated !!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
scelikok

SplunkTrust
12-08-2020
04:06 AM
@vijkuma , please try below;
| stats count by "response time" _time
| rename "response time" as "time_taken"
| rangemap field=time_taken upto_5_sec=0-5000 default=more_then_5_sec
| bin span=1d _time
| stats sum(count) as count by _time range
| stats list(range) as range list(count) as count by _time
If this reply helps you an upvote and "Accept as Solution" is appreciated.
