topic Re: How to assign numeric values based on counts? in Splunk Search

How to assign numeric values based on counts?

yagbootz48 — Tue, 29 Sep 2020 20:26:50 GMT

Hello,

I need some help. I'm trying to make a search where I take recipient_count and assign a "value" based on how many recipients there are. For example, recipient_count greater than or equal to 25 value=5, recipient_count range is between 50-99 value=7, recipient_count greater than or equal to 100 value=9

Any ideas how I could accomplish this?

Thanks in advance!

Re: How to assign numeric values based on counts?

thambisetty — Sat, 14 Jul 2018 15:27:59 GMT

try something like below,

| your base search
| eval value=case(recipient_count>=25 AND recipient_count<=50 ,5,recipient_count>50 AND recipient_count<=99,7,recipient_count>=100,9)

Re: How to assign numeric values based on counts?

woodcock — Sat, 14 Jul 2018 22:03:01 GMT

Check out the rangemap command:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap

Re: How to assign numeric values based on counts?

yagbootz48 — Tue, 17 Jul 2018 00:35:46 GMT

@thambisetty thanks!