topic Re: How can I display ranges as text min - max? in Splunk Search

How can I display ranges as text min - max?

grantsmiley — Fri, 15 Jun 2018 14:10:24 GMT

If I have data such as this:
SensorNo A B C D....Z AA AB....
123 2.4 2.5 2.6 1.0 ....89.1
124 8.6 2.6 3.6 5.7 ....
125 5.6 2.55 4.6 12.1....

And I want a table that shows the ranges of each value, such as in:

 | stats min(A) as minA max(A) as  maxA|eval rangeA=min(A)+" to "+maxA

Would look like:

minA    maxA     rangeA
2.4        8.6         2.6 to 8.6

I do not know how many fields are going to be in this data set in advance but I want that range for all of them, A thru however many there are. Doing that stats naming and eval isn't going to work because I can't predefine how many fields there are. I found I can get the min, max, and max-min using:

 |stats min() max() range()

However, this results in 3x the number of fields I want and a goofy sort of the columns.

The ultimate goal is to drop the fields min(A) max(A) and just display the range in the human readable form "2.6 to 8.6"
|stats.... |fields - min() max()
or something like that

Thanks in advance

Re: How can I display ranges as text min - max?

grantsmiley — Tue, 29 Sep 2020 20:04:00 GMT

Another query that describes what I want, but this one doesn't work:
|stats min() as min* max() as max* by Spread |eval range*=max*-min*

gives an error on the eval piece, stats part works well.

Re: How can I display ranges as text min - max?

kmorris_splunk — Fri, 15 Jun 2018 14:56:16 GMT

I think you have your syntax incorrect. Try:

| stats min(*) as min* by Spread

I'm not sure about the eval portion, but start with this for now. I can test the other bit out later.

Re: How can I display ranges as text min - max?

somesoni2 — Fri, 15 Jun 2018 14:59:08 GMT

You need foreach command here to dynamically process fields.

your current search giving fields: SensorNo A B C D....Z AA AB.... 
| stats min(*) as min* max(*) as max*
| foreach min* [| eval "range<<MATCHSTR>>"='max<<MATCHSTR>>'." to ".'min<<MATCHSTR>>' ]
| table range*

Re: How can I display ranges as text min - max?

grantsmiley — Fri, 15 Jun 2018 15:00:25 GMT

It works with or without the * inside the min() parenthesis, splunk documentation for aggregate functions indicates to not use the star so I didn't. That part works fine, the range piece is what I haven't been able to figure out.

Re: How can I display ranges as text min - max?

grantsmiley — Fri, 15 Jun 2018 15:05:04 GMT

That works beautifully... thank you. I'm not sure why, but I will have to read about that part.