Here is one way:
| makeresults
| eval raw="[8/7/19 1:30:35:977 MST] 00000232 MyClass I Method Process | ProcessingTime=8ms
host=myHost source=/location/SystemOut.log###[8/7/19 1:30:36:977 MST] 00000232 MyClass I Method Process | ProcessingTime=123ms
host=myHost source=/location/SystemOut.log###[8/7/19 1:30:37:011 MST] 00000232 MyClass I Method Process | ProcessingTime=1001ms
host=myHost source=/location/SystemOut.log###[8/7/19 1:30:39:533 MST] 00000232 MyClass I Method Process | ProcessingTime=1010ms
host=myHost source=/location/SystemOut.log"
| makemv delim="###" raw | mvexpand raw | rename raw AS _raw
| rex "ProcessingTime=(?<dur>\d+)ms"
| eval durBucket=case(dur<=100,"0-100ms",dur<=200,"101-200ms",dur<=500,"201-500ms",dur<=1000,"501-1000ms",dur<=5000,"1001-5000ms",1==1,"above 5000ms")
| stats count by durBucket
This extracts the duration into the field "dur" if you don't have access to this already. It uses case to manually bucket.
... View more