Splunk Search

Using "bucket" command, how to add the last bucket that counts all remaining values?

andrewpagans
Path Finder

I am creating a chart using bucket command ( span 4 )
How can I add the last bucket that count all remaining values >16?

Thanks for support

alt text

Tags (4)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (adding the eval before your bucket command)

your base search | eval someHourField=if(someHourField >=16,">16",someHourField ) | bucket span=4 someHourField | ..rest of the search...

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this (adding the eval before your bucket command)

your base search | eval someHourField=if(someHourField >=16,">16",someHourField ) | bucket span=4 someHourField | ..rest of the search...

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!