https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327560#M4716 <P>How do I convert the string "1-4" to the multi-value field of {1,2,3,4}?</P> <P>Thank you so much for you help, looking forward to a response</P> Mon, 05 Jun 2017 20:20:38 GMT tcollins93 2017-06-05T20:20:38Z https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327560#M4716 <P>How do I convert the string "1-4" to the multi-value field of {1,2,3,4}?</P> <P>Thank you so much for you help, looking forward to a response</P> Mon, 05 Jun 2017 20:20:38 GMT https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327560#M4716 tcollins93 2017-06-05T20:20:38Z https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327561#M4717 <P>Try like this</P> <PRE><CODE>..your current search | eval multivaluedfield=mvrange(mvindex(split(yourstringfield,"-"),0),mvindex(split(yourstringfield,"-"),1)+1) </CODE></PRE> Mon, 05 Jun 2017 21:08:35 GMT https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327561#M4717 somesoni2 2017-06-05T21:08:35Z https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327562#M4718 <P>To break that down into a less efficient but more readable nearly-self-explaining code...</P> <PRE><CODE>...your current search | eval TheRange=split(yourstringfield,"-") | eval LowEnd=mvindex(TheRange,0) | eval HighEnd=tonumber(mvindex(TheRange,1))+1 | eval multivaluedfield=mvrange(LowEnd,HighEnd) </CODE></PRE> <P>The +1 is because mvrange halts when it gets to the high end of the range, not producing a result for that last step. You could use +.00000000001 and it would work the same. </P> Mon, 05 Jun 2017 21:23:47 GMT https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327562#M4718 DalJeanis 2017-06-05T21:23:47Z https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327563#M4719 <P>You need a <CODE>tonumber</CODE> around the <CODE>HighEnd's</CODE> call to <CODE>mvindex</CODE>.</P> Mon, 05 Jun 2017 22:04:43 GMT https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327563#M4719 woodcock 2017-06-05T22:04:43Z https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327564#M4720 <P>rakken sakken sassafrak mumble mumble... so many languages ... grekkle fraggle morgin frelling foldergarben overloaded operators smekk.... because no, + isn't enough of a <STRONG>clue</STRONG> for splunk... </P> Tue, 06 Jun 2017 14:30:37 GMT https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327564#M4720 DalJeanis 2017-06-06T14:30:37Z https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327565#M4721 <P>Turnabout is fair play!</P> Thu, 08 Jun 2017 02:36:31 GMT https://community.splunk.com/t5/Splunk-Dev/Convert-range-to-set/m-p/327565#M4721 woodcock 2017-06-08T02:36:31Z