topic Re: help on rangemap command with loadjob in Splunk Search

help on rangemap command with loadjob

jip31 — Thu, 21 Feb 2019 08:04:36 GMT

I use the search below in order to display GOOD or BAD in a panel
When I execute the query i have a result
But I call this search from a loadjob command and I have never results

eventtype=Charge AND (NOT host=E* AND NOT
 host=I*)
| stats first(FullChargedCapacity) AS FullChargedCapacity first(DesignedCapacity) AS DesignedCapacity first(_time) AS _time 
| eval Wear_Rate = 100-(FullChargedCapacity *100/DesignedCapacity) 
| eval Status=if(Wear_Rate>5, "GOOD", "BAD") 
| table Status


| loadjob savedsearch="admin:XX:FO_BatteryHealth_Status" 
| table Status 
| eval severity=case(Status="GOOD", 0, Status="BAD", 1, true(), 999) 
| rangemap field=severity low=0-0 severe=1-1 default=guarded

Could you help me please???

Re: help on rangemap command with loadjob

ashajambagi — Thu, 21 Feb 2019 09:22:56 GMT

Try using this

| savedsearch "admin:XX:FO_BatteryHealth_Status" 
     | table Status 
     | eval severity=case(Status="GOOD", 0, Status="BAD", 1, true(), 999) 
     | rangemap field=severity low=0-0 severe=1-1 default=guarded

Re: help on rangemap command with loadjob

jip31 — Thu, 21 Feb 2019 13:19:26 GMT

no it doesnt works....

Re: help on rangemap command with loadjob

ashajambagi — Fri, 22 Feb 2019 05:05:50 GMT

Can you tell the error you are getting when you run the search?

Re: help on rangemap command with loadjob

ashajambagi — Fri, 22 Feb 2019 05:08:25 GMT

 | savedsearch "FO_BatteryHealth_Status" 
      | table Status 
      | eval severity=case(Status="GOOD", 0, Status="BAD", 1, true(), 999) 
      | rangemap field=severity low=0-0 severe=1-1 default=guarded

Try this

Re: help on rangemap command with loadjob

jip31 — Fri, 22 Feb 2019 17:25:55 GMT

I have no errors its just empty

Re: help on rangemap command with loadjob

jip31 — Fri, 22 Feb 2019 17:26:53 GMT

Nothing...

Re: help on rangemap command with loadjob

ashajambagi — Sat, 23 Feb 2019 17:48:39 GMT

Try running the query line by line,let me know when you are not able to see the results.
/or share a sample event

Re: help on rangemap command with loadjob

vinod94 — Tue, 29 Sep 2020 23:20:37 GMT

Hey dyude @jip31 ,

If you are running this search | loadjob savedsearch="admin:XX:FO_BatteryHealth_Status" .. please check the app OR report name, might be a spelling issue

if its coming in a normal search, then it should come with loadjob also ..may be you are missing out something

Ders another way you can run a savedsearch with loadjob command, ie with the search_id

Just open the report name in search and then inspect job ... in the job inspector URL you will find sid=blahblah

|loadjob blahblah

You can refer this doc

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Loadjob

Let me know if this works!