Splunk Search

Results on daily basis with rangemap

vijkuma
Engager

My Query : --- | stats count by "response time" | rename "response time" as "time_taken" | rangemap field=time_taken upto_5_sec=0-5000 default=more_then_5_sec | stats sum(count) by range

How can i get this result distributed on daily basis.

Current result : 

upto_5_sec100
more_then_5_sec1

 

Expected result :

2020-12-05upto_5_sec80
 more_then_5_sec0
   
2020-12-06upto_5_sec20
 more_then_5_sec1

 

Labels (3)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

@vijkuma , please try below;

| stats count by "response time" _time
| rename "response time" as "time_taken" 
| rangemap field=time_taken upto_5_sec=0-5000 default=more_then_5_sec 
| bin span=1d _time 
| stats sum(count) as count by _time range 
| stats list(range) as range list(count) as count by _time
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

vijkuma
Engager

This worked. @scelikok  Thanks for the help. Much appreciated !!! 

0 Karma

scelikok
SplunkTrust
SplunkTrust

@vijkuma , please try below;

| stats count by "response time" _time
| rename "response time" as "time_taken" 
| rangemap field=time_taken upto_5_sec=0-5000 default=more_then_5_sec 
| bin span=1d _time 
| stats sum(count) as count by _time range 
| stats list(range) as range list(count) as count by _time
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...