topic Re: Eval fields with decimals in Dashboards & Visualizations

How to eval fields with decimals?

marceldera — Fri, 21 Oct 2022 14:46:37 GMT

I am trying to group range of decimal number: Range between 10.0.0 and10.15 =Medium

10.16 -11=High

11.1-11.5=critical

for example:

Severity

10.15.4 12.6 12.6.0

10.15.7

10.15.7 10.15.7 12.6 12.6

10.15.7 12.5.1 12.6 12.6.0

10.15.7 12.6 12.6.0

11.0 12.5.1

11.0 12.6 12.6.0

11.0.1 12.3.1 12.6 12.6.0

11.2 12.6 12.6.0

11.2.3 11.6.3 12.2.1 12.6 12.6.0

11.2.3 12.6 12.6.0

11.4 12.5.1

11.4 12.5.1 12.5.1 12.6 12.6

11.4 12.6 12.6.0

11.5.1 12.6 12.6.0

11.5.2 11.6.2 12.6 12.6.0

11.5.2 11.7 11.7.0

11.5.2 12.2.1 12.5.1

11.5.2 12.2.1 12.6 12.6.0

11.5.2 12.6 12.6.0

11.6 11.6.0

11.6 11.6.2 12.2.1 12.6 12.6.0

11.6 11.6.2 12.3.1

Re: Eval fields with decimals

richgalloway — Fri, 21 Oct 2022 12:23:51 GMT

A sequence of characters with more than one decimal point is not a number so Splunk will not treat it as such.

What problem are you trying to solve?

Re: Eval fields with decimals

marceldera — Mon, 24 Oct 2022 14:31:37 GMT

I am trying to restructure a data for this purpose

For all MAC OS between 10.15 and 10.99 = Catalina

For all MAC OS between 11:00 to 11:99 = Big Sur

For all MAC OS between 12:00 to 12:99 = Monterey

Field name is:

Base MAC OS

10.15.4

10.15.7

11.0

11.0.1

11.2

11.2.3

11.3.1

11.4

11.5.1

11.5.2

11.6

11.6.1

11.6.2

11.6.3

11.6.4

11.6.5

11.6.6

11.6.7

11.6.8

11.7

12.0.1

12.1

12.2

12.2.1

12.3

12.3.1

12.4

12.5

12.5.1

12.6

Re: How to eval fields with decimals?

richgalloway — Mon, 24 Oct 2022 15:28:43 GMT

There may be other ways to do this, but here's one. It converts the version strings into integers, which are easy to compare or test in ranges.

... | eval versint = split(version, ".") ```We use separate fields because printf won't accept mvindex as an argument``` | eval major=mvindex(versint, 0), minor=mvindex(versint,1), maint=mvindex(versint,2) ```Handle missing 3rd-level number``` | fillnull value=0 maint | eval versint = printf("%02d%02d%02d", major, minor, maint) ...

This assume each level of the version string can be a 2-digit number. Feel free to adjust the printf format to allow for 3-digit number, if necessary.

Re: How to eval fields with decimals?

somesoni2 — Mon, 24 Oct 2022 15:29:25 GMT

Try something like this

your base search | eval OS_Name=case(match('Base MAC OS',"10\..*"),"Catalina", match('Base MAC OS',"11\..*"),"Big Sur",match('Base MAC OS',"12\..*"),"Monterey", true(),"Unknown")