Splunk Search

how to set not continuous number span for bucket value

cheriemilk
Path Finder

Hi team,

I have such event in splunk that log the employee number in each online meeting. I want to 

find and sats the employee number distribution and percentage%

I have below query that the bin span is continuous number 100.

<baseQuery>
|bin empNumber span=100
|stats count by empNumber
|eventstats sum(count) as total
|eval ratio%=round(empNumber/total*100,2)
|fields - total,empNumber
|sort - ratio%

 

But now the stats requirement is changed. Because 90% online meeting has employee number less than 100, so I want to set such not continuous bins in one query

1) for online meeting that  employee number less than 100, I want to set the bin value to 10

2)for online meeting that employee number greater than 100, I want to set the bin value to 100

And I don't want to query two times, stats by binvalue=100 first, then stats binvalue=10 again. I want to make it happen in one query.

Questions: how to change  my existing query to meet the query requirement.

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval empNumber=if(empNumber<100,(floor(empNumber/10)*10)."-".(floor((empNumber+10)/10)*10),(floor(empNumber/100)*100)."-".(floor((empNumber+100)/100)*100))
0 Karma
Get Updates on the Splunk Community!

Cannot push config from deployer to search head cluster

Hello,I recently upgraded our deployer/deployment server from 8.1.6 to version 9.0 and when I try to push ...

Subsearch: How to create a search which returns multiple values?

Hi, I have a search query which returns multiple values. For example, the search query returns abc, def, ...

Timecharts look like very flat

<span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Jennifer_0-1656485114286.png" ...