Splunk Search

search help - stats of a count by that field... but in band ranges?

hiddenkirby
Contributor

i need some search help...

index=myindex | somefilter | stats count(field) by field

gives me close to what i want...

but i want the counts of that field between certain defined ranges... like count(field) > 50 and < 500 or something.

Any thoughts? I expect it's easy 😕

TIA,
Kirby

Tags (2)
0 Karma
1 Solution

RicoSuave
Builder

I think the only way you are going to be able to group results in that way is by using the rangemap command.

index=myindex | somefilter | stats count(field) by field | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow

or maybe this

index=myindex | somefilter | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow | stats count(field) by field

You can adjust the ranges to your liking. Let me know if this works.

View solution in original post

bojanz
Communicator

Kirby,

Do you just want to display results that are between these two values (so the counted number, not the field)? This should help:

index=myindex | somefilter | stats count(field) AS num by field | where num > 50 AND num < 500

Or you want to count fields that have values between 50 and 100?

index=myindex | somefilter | where field > 50 AND field < 500 | stats count(field) by field
0 Karma

RicoSuave
Builder

I think the only way you are going to be able to group results in that way is by using the rangemap command.

index=myindex | somefilter | stats count(field) by field | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow

or maybe this

index=myindex | somefilter | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow | stats count(field) by field

You can adjust the ranges to your liking. Let me know if this works.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...