Try something like this | eval bucket=case(dur < 30, 0, dur <= 60, 1, dur <= 120, 2, dur <= 240, 3, dur > 240, 4)
| stats count as "Number of Queries" by bucket
| append
[| makeresults
| fields ...
See more...
Try something like this | eval bucket=case(dur < 30, 0, dur <= 60, 1, dur <= 120, 2, dur <= 240, 3, dur > 240, 4)
| stats count as "Number of Queries" by bucket
| append
[| makeresults
| fields - _time
| eval bucket=mvrange(0,5)
| mvexpand bucket
| eval "Number of Queries"=0]
| stats sum('Number of Queries') as "Number of Queries" by bucket
| eval bucket=mvindex(split("Less than 30sec,30sec - 60sec,1min - 2min,2min - 4min,More than 4min", ","), bucket)