I have a requirement wherein I am using bucket to calculate range and their values.
host="hobbes8" |search success OR fail|eventstats count(txnId) as gtotal |bucket apitime bins=100|eventstats count(txnId) as total by apitime|eval percent=100*total/gtotal |table api_time,percent,total.
I am getting my result but im getting many dupliicate entries. An when I am using stats I am getting the error. api_time should be numerical. Can you help me with this.
I need the result like this.
api_time percent total
1 1500-1600 0.277316 10
2 400-500 6.211869 224
3 800-900 2.329451 84
4 300-400 6.267332 226
Stats does have the ability to print non-numerical values; I'm not sure why it would complain about them, unless there was a syntax error somewhere in your query . Try the following instead of the pipe to "table" to display your results:
... | stats values(percent) AS "Percent", values(total) AS "Total" by api_time
If you still get duplicate values, you might want to look into the "dedup" command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dedup