bucket
Use the bucket
command to group the log records into
buckets based on the range of values of a field. The buckets can be created automatically
based on the values of the field or can be specified.
Syntax
* | bucket [<bucket_options>] <field_name> [<ranges>]
Parameters
The following table lists the parameters used in this command, along with their descriptions.
Parameter | Description |
---|---|
|
Syntax:
|
|
Specify the numeric field to use for grouping. |
|
Syntax:
|
The following command automatically creates a bucket of the field Query Duration
:
* | bucket 'Query Duration'
The following command automatically creates 5
buckets of the field Query Duration
:
* | bucket maxbuckets=5 'Query Duration'
The following command automatically creates buckets with the names fast
, medium
, and slow
of the field Query Duration
:
* | bucket 'Query Duration' fast=0-1000, medium=1001-5000, others=slow
The following command automatically creates buckets of the field
Group Duration
which is then used for
timestats analysis:
* | link | bucket 'Group Duration' | timestats sum('Content Size Out') by 'Group Duration'
The following command automatically creates buckets of the field
Content Size Out
which is then used for
timestats analysis:
* | link | stats sum('Content Size Out') as 'Content Size Out' | bucket 'Content Size Out' | timestats Count by 'Content Size Out'