bucket
Use the bucket command to group the log records into
buckets based on the range of values of a field. The buckets can be created automatically
based on the values of the field or can be specified.
Syntax
* | bucket [<bucket_options>] <field_name> [<ranges>]Parameters
The following table lists the parameters used in this command, along with their descriptions.
| Parameter | Description |
|---|---|
|
|
Syntax:
|
|
|
Specify the numeric field to use for grouping. |
|
|
Syntax:
|
The following command automatically creates a bucket of the field Query Duration:
* | bucket 'Query Duration'The following command automatically creates 5 buckets of the field Query Duration:
* | bucket maxbuckets=5 'Query Duration'The following command automatically creates buckets with the names fast, medium, and slow of the field Query Duration:
* | bucket 'Query Duration' fast=0-1000, medium=1001-5000, others=slowThe following command automatically creates buckets of the field
Group Duration which is then used for
timestats analysis:
* | link | bucket 'Group Duration' | timestats sum('Content Size Out') by 'Group Duration'The following command automatically creates buckets of the field
Content Size Out which is then used for
timestats analysis:
* | link | stats sum('Content Size Out') as 'Content Size Out' | bucket 'Content Size Out' | timestats Count by 'Content Size Out'