Search Command: Quantify

Thanks For Downloading!

Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows:

Windows: Decompress the downloaded file using a tool like 7-Zip and place the resulting folder into %PROGRAMFILES%\Splunk\etc\apps. Then restart Splunk using the splunk restart command or the GUI.

Unix/Linux: Decompress the downloaded file using a tool like tar -xvf and place the resulting folder into $SPLUNK_HOME/etc/apps. Then restart Splunk using the splunk restart command or the GUI.

Quantify is a reworking of the 'rangemap' command, allowing for the dynamic creation of categories or 'ranges' in which to group data.

Whereas 'rangemap' requires us to know our categories and ranges, beforehand, quantify will generate categories based on the data. Quantify adds a 'range' field to each event that denotes which categories the event falls into. The 'range' field is a space-delimited list that can be piped into makemv to create a multivalued field (i.e. | makemv range) when needed.

** TODO: Floating point support will be added to a future release.

Syntax:
quantify (max=<int> | maxfield=<field>)+ (min=<int> | minfield=<field>)+ [overlap=high|low] [label=high|low|mid|range] bins=<int> field=<field>

'bins' - how many categories to create.
'field' - which field contains the values to
'min' - the floor to use when calculating categories. (Only valid when 'minfield' is not specified.)
'max' - the ceiling to use when calculating categories. (Only valid when 'maxfield' is not specified.)
'maxfield' - the name of the field that contains the cieling to use for categories.
'minfield' - the name of the field that contains the floor to use for categories.
'overlap' - cause categories to all begin or end on the same value, allowing events to fall into multiple categories.
overlap=low - all categories will begin with the same floor ('min' or the value of 'minfield' by default).
overlap=high - all categories will end with the same ceiling ('max' or the value of 'maxfield' by default).
'label' - determines how to label the categories:
high - uses the highest value of category for its label.
low - uses the lowest value of a category for its label.
mid - uses the median value of a category for its label.
range - names the category according to its range, like the rangemap command (i.e. 'low-high'). This is the default.

NOTE: 'Quantify' attempts to split all categories, equally; however, if category sizes cannot be divided, equally, 'Quantify' will stretch the highest-value category.

Examples:
index=_internal | head 100 | streamstats count AS c | eventstats max(c) AS max_c min(c) AS min_c | quantify label=range maxfield=max_c bins=4 field=c | stats count by range
This will split the data into four categories, each category representing an equal division based on the ceiling provided by the 'total' field. This search creates (0-24, 25-49, 50-74, 75-100)

index=_internal | head 100 | streamstats count AS c | eventstats max(c) AS max_c min(c) AS min_c | quantify overlap=low label=range minfield=min_c maxfield=max_c bins=4 field=c | stats count by range
This will split the data into four overlapping categories, each category representing an equal division based on the ceiling provided by the 'total' field. This search creates (1-25, 1-50, 1-75, 1-100)

index=_internal | head 100 | streamstats count AS c | quantify label=low max=50 min=1 bins=2 field=c | stats count by range
This will create two dynamic categories (1-25 labeled '1' , 26-50 labeled '26'). Events whose c value are outside this range will be quantified as OTHER.