Deployment Architecture

How to auto-range with a descending percent manner

wait4amigo
New Member

For example, I want my data is ranged as:

Value Percent
Larger than 0 100%
Larger than 5 95%
Larger than 10 91%
...
Larger than 85 15%
Larger than 90 8%
...

Since the range will be divided to many spans, I don't want to create span manually (through rangemap or case), instead I want to use "bucket span=" to auto-divide the range, not sure if we can achieve this or not...

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi wait4amigo,

you can use bucket Value span=5 which will set Value into a discrete set. The resulting values for Value will look like this 0-5 or 5-10 but it should work.

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi wait4amigo,

you can use bucket Value span=5 which will set Value into a discrete set. The resulting values for Value will look like this 0-5 or 5-10 but it should work.

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

Well, you asked for auto-divide range and this is done with bucket.
The "0-5, 0-10, 0-15..." or "0-100, 0-95, 0-90..." examples could be solved with rangemap, but you have to assign the ranges manually.
The "larger as.." examples could be solved with eval but again it must be defined manually or at least with some fancy math magic.

0 Karma

wait4amigo
New Member

Thanks for your answer, but my question is not only for "discrete set", I want the resulting values to be "0-5, 0-10, 0-15..." or "0-100, 0-95, 0-90..."

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...