Splunk Search

search help - stats of a count by that field... but in band ranges?

hiddenkirby
Contributor

i need some search help...

index=myindex | somefilter | stats count(field) by field

gives me close to what i want...

but i want the counts of that field between certain defined ranges... like count(field) > 50 and < 500 or something.

Any thoughts? I expect it's easy 😕

TIA,
Kirby

Tags (2)
0 Karma
1 Solution

RicoSuave
Builder

I think the only way you are going to be able to group results in that way is by using the rangemap command.

index=myindex | somefilter | stats count(field) by field | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow

or maybe this

index=myindex | somefilter | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow | stats count(field) by field

You can adjust the ranges to your liking. Let me know if this works.

View solution in original post

bojanz
Communicator

Kirby,

Do you just want to display results that are between these two values (so the counted number, not the field)? This should help:

index=myindex | somefilter | stats count(field) AS num by field | where num > 50 AND num < 500

Or you want to count fields that have values between 50 and 100?

index=myindex | somefilter | where field > 50 AND field < 500 | stats count(field) by field
0 Karma

RicoSuave
Builder

I think the only way you are going to be able to group results in that way is by using the rangemap command.

index=myindex | somefilter | stats count(field) by field | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow

or maybe this

index=myindex | somefilter | rangemap field=yourfield Great=1-200 Good=201-400 Acceptable=401-600 default=Slow | stats count(field) by field

You can adjust the ranges to your liking. Let me know if this works.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...