Whereas 'rangemap' requires us to know our categories and ranges, beforehand, quantify will generate categories based on the data. Quantify adds a 'range' field to each event that denotes which categories the event falls into. The 'range' field is a space-delimited list that can be piped into makemv to create a multivalued field (i.e. | makemv range) when needed.
** TODO: Floating point support will be added to a future release.
Syntax:
quantify (max=<int> | maxfield=<field>)+ (min=<int> | minfield=<field>)+ [overlap=high|low] [label=high|low|mid|range] bins=<int> field=<field>
'bins' - how many categories to create.
'field' - which field contains the values to
'min' - the floor to use when calculating categories. (Only valid when 'minfield' is not specified.)
'max' - the ceiling to use when calculating categories. (Only valid when 'maxfield' is not specified.)
'maxfield' - the name of the field that contains the cieling to use for categories.
'minfield' - the name of the field that contains the floor to use for categories.
'overlap' - cause categories to all begin or end on the same value, allowing events to fall into multiple categories.
overlap=low - all categories will begin with the same floor ('min' or the value of 'minfield' by default).
overlap=high - all categories will end with the same ceiling ('max' or the value of 'maxfield' by default).
'label' - determines how to label the categories:
high - uses the highest value of category for its label.
low - uses the lowest value of a category for its label.
mid - uses the median value of a category for its label.
range - names the category according to its range, like the rangemap command (i.e. 'low-high'). This is the default.
NOTE: 'Quantify' attempts to split all categories, equally; however, if category sizes cannot be divided, equally, 'Quantify' will stretch the highest-value category.
Examples:
index=_internal | head 100 | streamstats count AS c | eventstats max(c) AS max_c min(c) AS min_c | quantify label=range maxfield=max_c bins=4 field=c | stats count by range
This will split the data into four categories, each category representing an equal division based on the ceiling provided by the 'total' field. This search creates (0-24, 25-49, 50-74, 75-100)
index=_internal | head 100 | streamstats count AS c | eventstats max(c) AS max_c min(c) AS min_c | quantify overlap=low label=range minfield=min_c maxfield=max_c bins=4 field=c | stats count by range
This will split the data into four overlapping categories, each category representing an equal division based on the ceiling provided by the 'total' field. This search creates (1-25, 1-50, 1-75, 1-100)
index=_internal | head 100 | streamstats count AS c | quantify label=low max=50 min=1 bins=2 field=c | stats count by range
This will create two dynamic categories (1-25 labeled '1' , 26-50 labeled '26'). Events whose c value are outside this range will be quantified as OTHER.
README updated -- label option was incorrectly noted in the syntax.
appIcon.png added to package, and version incremented to update older installs.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.