Deployment Architecture

Histogram and bucket size

uthornander_spl
Splunk Employee
Splunk Employee

Hi
I have some proprietary log data that gives 3 different response times for each event.
These are extracted into Timer1,Timer2,Timer3

What I want to achieve is to count the number of timer events that fall into a bucket where i can control the bucket size.

That means that just countingh the number of 0,3 second response time events is not enough, but I also want to control so that it is counted in bucket that holds 0-1 second response times.

As a twist to it, I don't know how many buckets I need, or rather I don't know how long the longest response time is, but I would like to truncated/gather up the values over a certain value..

Then I want to plot the count on the Y axis, and the buckets on the X axis.

I get somewhere by using:

|bin span=1 timer1 as Rtime | chart count as "Count" by Rtime

But then I'm stuck.

UT
0 Karma

kskoeld
New Member

Working on the same problem this did it for me:

timer1="*" 
| bin span=0.01 timer1 as "time in ms" 
| chart count as "count" by "time in ms"

However I can't figure out hot to get the labels for the buckets to be shown on the x-axis:
alt text

What I would expect are the following buckets to be shown on the x-axis:
alt text

If they are missing because there are just to many to be displayed then how can I configure to say only display every 10th or so?

,working on the same problem this did it for me:
timer1="*"
| bin span=0.01 timer1 as "time in ms"
| chart count as "count" by "time in ms"

0 Karma

uthornander_spl
Splunk Employee
Splunk Employee

So how did you get the other timers in (and preferably coded in another color)?

UT
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...