bucket

Use the bucket command to group the log records into buckets based on the range of values of a field. The buckets can be created automatically based on the values of the field or can be specified.

Syntax

* | bucket [<bucket_options>] <field_name> [<ranges>]

Parameters

The following table lists the parameters used in this command, along with their descriptions.

Parameter Description

bucket_options

Syntax: [span = <size>] [maxbuckets= <maxbuckets>]

size specifies the size of each bucket.  If the span is not specified, then the buckets will be evenly spaced between the minimum and maximum values.

maxbuckets specifies the maximum number of buckets to create.  If not specified, then the default is 10.

field_name

Specify the numeric field to use for grouping.

ranges

Syntax: [<range>] [,<range>, ...] [, others = <others>]

range syntax: [alias] = <lower> - <upper>

others specifies the name of the bucket that has values which don’t fit into any of the specified buckets. If not specified, the name is others.

The following command automatically creates a bucket of the field Query Duration:

* | bucket 'Query Duration'

The following command automatically creates 5 buckets of the field Query Duration:

* | bucket maxbuckets=5 'Query Duration'

The following command automatically creates buckets with the names fast, medium, and slow of the field Query Duration:

* | bucket 'Query Duration' fast=0-1000, medium=1001-5000, others=slow

The following command automatically creates buckets of the field Group Duration which is then used for timestats analysis:

* | link | bucket 'Group Duration' | timestats sum('Content Size Out') by 'Group Duration'

The following command automatically creates buckets of the field Content Size Out which is then used for timestats analysis:

* | link | stats sum('Content Size Out') as 'Content Size Out' | bucket 'Content Size Out' | timestats Count by 'Content Size Out'