Splunk Search

bin with specific buckets

dtakacssplunk
Explorer

Hello I want to use bin to categorize my runtimes into specific buckets. lets' say I want to show runtime and bucketize it every hour into buckets 0-20, 20-40, 40-60, 60 - maxtime. How do I do this?

Currently my query is like this:
index=* ..... | bucket _time span=1h | bin span=20 end=200 runTime | eval epoachtime=_time | stats count by epoachtime, runTime | makecontinuous runTime | fillnull count

and I get the following result :

epoachtime runTime count
1532620800 0-20 2263
1532624400 0-20 3097
1532628000 0-20 2249
1532617200 0-20 45
1532631600 0-20 1615
1532631600 20-40 3
1532631600 40-60 1
60-80 0
80-100 0
100-120 0
120-140 0
140-160 0
160-180 0
180-200 0
200-220 0
1532620800 220-240 1
1532631600 240-260 2
1532620800 260-280 1
1532631600 260-280 1

Tags (1)
0 Karma

nplamondon
Communicator

If I understand your question correctly, you want to see events classified by groups of runtimes.

You might try the eval case function like
... | eval timeBin=case(runTime < 20, "0-20", runTime < 40, "0-40"...

This would give you a new field timeBin that would have those string values you could use to group by, etc.

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/ConditionalFunctions

0 Karma

dtakacssplunk
Explorer

yes I was thinking of the solution you proposed, but I wish the bin function min / max arguments somehow could be used to achieve something like it...

0 Karma

dtakacssplunk
Explorer

I figure I can do things like this:

index=* ..... | **eval runtimewithmax=case(runTime > 60, 61, true(), runTime)* | bucket _time span=1h | bin span=20 runtimewithmax | eval epoachtime=_time | stats count as eventcount by epoachtime, context, sourcetype, gdpr, index, path, runtimewithmax

but I was hoping there is a better way.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...