topic Re: Using parameters in rangemap in Splunk Search

Using parameters in rangemap

stefano_guidoba — Thu, 13 Dec 2012 12:09:26 GMT

Hi,

what I want to achieve is a dynamic (datetime based) rangemap of an application's exceptions. So, instead of terminating my search with a simple

... | rangemap low=0-100 elevated=101-200 default=severe

I would rather something like that:

... | rangemap low=0-thr elevated=thr-2*thr default=severe

where thr is a value extracted from a lookup table. Is this possible?
Regards,

Stefano

Re: Using parameters in rangemap

martin_mueller — Thu, 13 Dec 2012 14:11:00 GMT

Rangemap only takes explicit integers. However, rangemap basically only is shorthand for case:

... | eval range = case(field < low_threshold, "low", field < elevated_threshold, "elevated", field >= elevated_threshold, "severe")

Note, this is not exactly the same as the first rangemap you quote - negative values get the default from rangemap but low from this case. Just take care to specify the case conditions accurately to match your requirements.

Re: Using parameters in rangemap

stefano_guidoba — Thu, 13 Dec 2012 14:20:35 GMT

Hi Martin,

in the end I did exactly what you suggested encasing the eval command in a macro. Thanks for your suggestion,
regards

Stefano