Just after I wrote the question it came to me, the eval command:
search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount
Someone with more experiance maybe can check if this is the correct way to do it.
Just after I wrote the question it came to me, the eval command:
search | eval amount= if(amount < 100, "99", amount) | eval amount= if(amount > 500, "501", amount)| bucket amount span=50 | stats count by amount | sort by amount
Someone with more experiance maybe can check if this is the correct way to do it.