Puts continuous numerical values into discrete sets.
bucket [<bucketing-option>]* <field> [as <field>]
- Datatype: <field>
- Description: Specify a field name.
- Datatype: bins | minspan | span | start-end
- Description: Discretization options. See "Bucketing options" for details.
- Datatype: <string>
- Description: A new name for the field.
- Syntax: bins=<int>
- Description: Sets the maximum number of bins to discretize into.
- Syntax: minspan=<span-length>
- Description: Specifies the smallest span granularity to use automatically inferring span from the data time range.
- Syntax: span = <log-span> | <span-length>
- Description: Sets the size of each bucket, using a span length based on time or log-based span.
- Syntax: end=<num> | start=<num>
- Description:Sets the minimum and maximum extents for numerical buckets. Data outside of the [start, end] range is discarded.
Log span syntax
- Syntax: [<num>]log[<num>]
- Description: Sets to log-based span. The first number is a coefficient. The second number is the base. If the first number is supplied, it must be a real number >= 1.0 and < base. Base, if supplied, must be real number > 1.0 (strictly greater than 1).
Span length syntax
- Syntax: <int>[<timescale>]
- Description: A span of each bin. If discretizing based on the _time field or used with a timescale, this is treated as a time range. If not, this is an absolute bucket length.
- Syntax: <sec> | <min> | <hr> | <day> | <month> | <subseconds>
- Description: Time scale units. If discretizing based on the _time field, this defaults to seconds.
- Syntax: s | sec | secs | second | seconds
- Description: Time scale in seconds.
- Syntax: m | min | mins | minute | minutes
- Description: Time scale in minutes.
- Syntax: h | hr | hrs | hour | hours
- Description: Time scale in hours.
- Syntax: d | day | days
- Description: Time scale in days.
- Syntax: mon | month | months
- Description: Time scale in months.
- Syntax: us | ms | cs | ds
- Description: Time scale in microseconds (us), milliseconds (ms), centiseconds (cs), or deciseconds (ds).
Puts continuous numerical values in fields into discrete sets, or buckets. The default field processed is _time. Note: Bucket is called by chart and timechart automatically and is only needed for statistical operations that timechart and chart cannot process.
Example 1: Return the average "thruput" of each "host" for each 5 minute time span.
... | bucket _time span=5m | stats avg(thruput) by _time host
Example 2: Bucket search results into 10 bins, and return the count of raw events for each bucket.
... | bucket size bins=10 | stats count(_raw) by size
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the bucket command.