When you have a set of events that share a field with a numeric value, you can group those events together according to various ranges of that value. For example, you could have a set of fields with that share SRTime, a field that measures service response time, and which has values ranging between 0 and 1200 ms. Assuming you've already extracted the SRTime field, you can use the rangemap command to break the potential ranges down into groups like so:
sourcetype=ApplicationLog SRTime="*" | rangemap field=SRTime Great=1-200 Good=201-400 Acceptable 401-600 default=Slow | stats count by range
This adds a new field to your events called "range" and then gives it a value according to the numeric value of "SRTime". The stats command then breaks your events up into groups according to the value of range that they have.
One of the problems that you'll find, however, is that the finished table/chart orders the counts of the "range" field alphabetically. So if you create a column chart from this, you'll see the columns in this order: Acceptable, Good, Great, Slow.
How do you adjust the search so that the columns are ordered according to their range (Great, Good, Acceptable, Slow)?
To do this, you extend the search by:
Here's what the amended search looks like after this sorting functionality is included:
sourcetype=ApplicationLog SRTime="*" | rangemap field=SRTime Great=1-200 Good=201-400 Acceptable 401-600 default=Slow | stats count by range | eval order = if(range="Great",0,if(range="Good",1,if(range="Acceptable",2,3))) | sort + order | fields - order
With this, you can create a column chart with columns labeled "Great," "Good," "Acceptable," and "Slow," in that order from left to right.
For a more detailed version of this rangemap command demonstration, see this topic in the Splunk User Manual.
To do this, you extend the search by:
Here's what the amended search looks like after this sorting functionality is included:
sourcetype=ApplicationLog SRTime="*" | rangemap field=SRTime Great=1-200 Good=201-400 Acceptable 401-600 default=Slow | stats count by range | eval order = if(range="Great",0,if(range="Good",1,if(range="Acceptable",2,3))) | sort + order | fields - order
With this, you can create a column chart with columns labeled "Great," "Good," "Acceptable," and "Slow," in that order from left to right.
For a more detailed version of this rangemap command demonstration, see this topic in the Splunk User Manual.
Thank you.