count by response time range

[jibiuthaman]

source aaa| eval Description=case(rt_sec>10, "G10", rt_sec>20, "G20", rt_sec>30, "G30", rt_sec>40, "G40") | stats count by Description

this seems to only give me results for G10 even though I have many cases with response times greater then 10 sec... if i just do source aaa rt_sec > 20, I get results. Please help me find the issue here.

[somesoni2 · Accepted solution]

Try this.

source=aaa | eval Description=case(rt_sec>10 AND rt_sec<=20,"G10", rt_sec>20 AND rt_sec<=30,"G20",rt_sec>30 AND rt_sec<=40,"G40",rt_sec>40,"G10")| stats count by Description

[jibiuthaman]

Work and thanks again..