Would a Splunk guru please explain what span=log2 does or why one might use it?

[aulbrich]

I've seen the documentation, but it doesn't really explain what or how it might be used.  I'm looking for a lightweight use case to help me understand it.  

Thanks!

[nwuest · Accepted solution]

Hi @aulbrich,

After reading the documentation with different examples, span=log2 would mean that whatever Splunk search you had in front of this argument would be " the search uses the span argument to bucket the duration into bins of log2 (span=log2). "

example:
sourcetype=access_* status=200 action=purchase | transaction clientip maxspan=10m | chart count BY duration span=log2

chart - Splunk Documentation  <-- Check around bullet 3 for the explanation.

That means that Splunk would take your search and sort it into the bin named "log2". 
Now when you specify a span before it, it would separate the results into equal bins so that none of them would be more or less than the other.
"If you specify a span of 10, then the bins are calculated in increments of 10. The bins are 0-9, 10-19, 20-29, and so forth."

bin - Splunk Documentation 

I do hope this helps with your question!

V/R,
nwuest

[aulbrich]

@nwuest Thank you very much!  Your answer helped quite a bit!