Refine your search:

I'm trying to set up a pie chart displaying the average response time to a particular server. The pie chart should have 3 buckets of varying width, corresponding to the average response:

  • 1st bucket: 0 <= Response Time < 6

  • 2nd bucket: 6 <= Response Time < 24

  • 3rd bucket: Response Time >= 24

I am not sure how to do this in Splunk; span seems to only take fixed values in determining bucket widths. I've currently just been using chart with span=6, but it would be a huge advantage to split up the data into the 3 buckets described above.

Any help would be much appreciated.

asked 02 Aug '11, 12:08

acdevlin's gravatar image

acdevlin
27715
accept rate: 37%

edited 02 Aug '11, 16:33


One Answer:

you can try to use the rangemap command to do what you want

.... | rangemap field=ResponseTime low=0-6, middle=6-24, default=high | stats count BY range

and then display the results as a pie chart

link

answered 02 Aug '11, 18:33

Ledion%20Bitincka's gravatar image

Ledion Bitincka ♦
1.5k36
accept rate: 35%

Perfect! Thank you very much.

(03 Aug '11, 09:44) acdevlin
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×134
×14

Asked: 02 Aug '11, 12:08

Seen: 476 times

Last updated: 03 Aug '11, 09:44

Copyright © 2005-2012 Splunk, Inc. All rights reserved.