Splunk Search

How do I create a histogram to show distribution?

earriaga
Explorer

I have a search like this:

My Search|chart count(data.url) as SongsPlayed  over userEmail

It gives me a list of users and the number of songs they listen to for a time.

I would like a chart that breaks down the users in groups, like those who listen between 0-10, the up to 20, 30 etc.

How do I do that in Splunk?

Eva

earriaga
Explorer

It is sorting the buckets as text, all the 10, 100 etc first. Is there a way to order the buckets as number? Or I am asking too much?
:)

0 Karma

woodcock
Esteemed Legend

Like this:

My Search
| stats count(data.url) AS songsPlayed BY userEmail
| bin songsPlayed span=10
| stats dc(userEmail) AS users BY songsPlayed

earriaga
Explorer

Hi, thank you, it is getting closer but it is still not working.

When I enter this:
index="mobile_app_tracking" event=song
|stats count(data.url) as SongsPlayed BY userEmail
| bin SongsPlayed span=10

I see results, emails with the bucket where they belong

alt text

But, when I put the whole thing as you suggested,

I get nothing, no results!

alt text

0 Karma

earriaga
Explorer

Yay, thank you very much!!!

0 Karma

woodcock
Esteemed Legend

Be sure to spread around the UpVotes and click Accept on the best answer to close the question.

0 Karma

woodcock
Esteemed Legend

You typed it in wrong (my answer has it right). You typed SongPlayed as the last word and it should be SongsPlayed. Missed it by >that< much!

0 Karma

woodcock
Esteemed Legend

Like this:

My Search | bin _time span=10s | stats count(data.url) AS SongsPlayed BY userEmail _time

earriaga
Explorer

Thank you that works, but it is giving me users per 10 seconds, I think?

I want to count number of users, and the number of songs they play.

My basic query gives me the user email and the number of songs they listen to.

What I want is to group those users in buckets, of those who listen between 0 and 10, those who listen to etc.
So for example, it would be a bar graph for each bucket of songs.
10 users play 0-10 songs
34 users play 11-20 songs
etc

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!