Deployment Architecture

Histogram and bucket size

uthornander_spl
Splunk Employee
Splunk Employee

Hi
I have some proprietary log data that gives 3 different response times for each event.
These are extracted into Timer1,Timer2,Timer3

What I want to achieve is to count the number of timer events that fall into a bucket where i can control the bucket size.

That means that just countingh the number of 0,3 second response time events is not enough, but I also want to control so that it is counted in bucket that holds 0-1 second response times.

As a twist to it, I don't know how many buckets I need, or rather I don't know how long the longest response time is, but I would like to truncated/gather up the values over a certain value..

Then I want to plot the count on the Y axis, and the buckets on the X axis.

I get somewhere by using:

|bin span=1 timer1 as Rtime | chart count as "Count" by Rtime

But then I'm stuck.

UT
0 Karma

kskoeld
New Member

Working on the same problem this did it for me:

timer1="*" 
| bin span=0.01 timer1 as "time in ms" 
| chart count as "count" by "time in ms"

However I can't figure out hot to get the labels for the buckets to be shown on the x-axis:
alt text

What I would expect are the following buckets to be shown on the x-axis:
alt text

If they are missing because there are just to many to be displayed then how can I configure to say only display every 10th or so?

,working on the same problem this did it for me:
timer1="*"
| bin span=0.01 timer1 as "time in ms"
| chart count as "count" by "time in ms"

0 Karma

uthornander_spl
Splunk Employee
Splunk Employee

So how did you get the other timers in (and preferably coded in another color)?

UT
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...