Splunk Search

Using "bucket" command, how to add the last bucket that counts all remaining values?

Path Finder

I am creating a chart using bucket command ( span 4 )
How can I add the last bucket that count all remaining values >16?

Thanks for support

alt text

Tags (4)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try like this (adding the eval before your bucket command)

your base search | eval someHourField=if(someHourField >=16,">16",someHourField ) | bucket span=4 someHourField | ..rest of the search...

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try like this (adding the eval before your bucket command)

your base search | eval someHourField=if(someHourField >=16,">16",someHourField ) | bucket span=4 someHourField | ..rest of the search...

View solution in original post

0 Karma