Deployment Architecture

How to auto-range with a descending percent manner

wait4amigo
New Member

For example, I want my data is ranged as:

Value Percent
Larger than 0 100%
Larger than 5 95%
Larger than 10 91%
...
Larger than 85 15%
Larger than 90 8%
...

Since the range will be divided to many spans, I don't want to create span manually (through rangemap or case), instead I want to use "bucket span=" to auto-divide the range, not sure if we can achieve this or not...

Tags (2)
0 Karma
1 Solution

MuS
Legend

Hi wait4amigo,

you can use bucket Value span=5 which will set Value into a discrete set. The resulting values for Value will look like this 0-5 or 5-10 but it should work.

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi wait4amigo,

you can use bucket Value span=5 which will set Value into a discrete set. The resulting values for Value will look like this 0-5 or 5-10 but it should work.

hope this helps ...

cheers, MuS

MuS
Legend

Well, you asked for auto-divide range and this is done with bucket.
The "0-5, 0-10, 0-15..." or "0-100, 0-95, 0-90..." examples could be solved with rangemap, but you have to assign the ranges manually.
The "larger as.." examples could be solved with eval but again it must be defined manually or at least with some fancy math magic.

0 Karma

wait4amigo
New Member

Thanks for your answer, but my question is not only for "discrete set", I want the resulting values to be "0-5, 0-10, 0-15..." or "0-100, 0-95, 0-90..."

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...