topic Re: What's wrong with my rangemap? in Splunk Search

What's wrong with my rangemap?

a212830 — Sun, 11 Oct 2015 01:37:47 GMT

Hi,

I'm trying out some searches learned at .conf. This one is supposed to provide lag info for indexing delays. Unfortunately, I can't get it to work. Any help is appreciated.

| metadata type=hosts   
| eval seconds_lag=(recentTime -lastTime)
| convert ctime(lastTime) as LastTime
| convert ctime(firstTime) as FirstTime
| convert ctime(recentTime) as IndexTime
| rangemap field=seconds_lag low=0-1800 elevated=1801-3600
| fields host,FirstTime,LastTime,IndexTime,seconds_lag,range

Re: What's wrong with my rangemap?

martin_mueller — Sun, 11 Oct 2015 10:44:52 GMT

That query seems to work for me. What results are you getting that appear wrong?

Re: What's wrong with my rangemap?

a212830 — Sun, 11 Oct 2015 12:06:24 GMT

I get:

Error in 'rangemap' command: Invalid range: '0-1800 elevated=1801-3600'. '-' expected.

I am running Splunk 6.1.9

Re: What's wrong with my rangemap?

badrinath_itrs — Sun, 11 Oct 2015 12:36:21 GMT

The rangemap command works fine with my splunk version 6.2.3 . Alternatively you can try with case statement for your requirement.

Re: What's wrong with my rangemap?

martin_mueller — Sun, 11 Oct 2015 15:18:31 GMT

Odd - 6.3.0 here.

Try one of the examples from http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/rangemap to narrow it down, if those work then modify from there.

Re: What's wrong with my rangemap?

maciep — Sun, 11 Oct 2015 18:21:10 GMT

Just a long shot, but did you copy and paste this search from somewhere else? Wondering if maybe the dash is like a long dash or something along those lines. If you typed it out yourself in the search bar, then that shouldn't be a problem.

Re: What's wrong with my rangemap?

MuS — Sun, 11 Oct 2015 19:25:51 GMT

This the answer, because the Em dash will cause this error. You can test it with the two following searches:

working:

| metadata type=hosts    
 | eval seconds_lag=(recentTime -lastTime)
 | convert ctime(lastTime) as LastTime
 | convert ctime(firstTime) as FirstTime
 | convert ctime(recentTime) as IndexTime
 | rangemap field=seconds_lag low=0-1800 elevated=1801-3600
 | fields host,FirstTime,LastTime,IndexTime,seconds_lag,range

not working:

| metadata type=hosts    
 | eval seconds_lag=(recentTime -lastTime)
 | convert ctime(lastTime) as LastTime
 | convert ctime(firstTime) as FirstTime
 | convert ctime(recentTime) as IndexTime
 | rangemap field=seconds_lag low=0—1800 elevated=1801—3600
 | fields host,FirstTime,LastTime,IndexTime,seconds_lag,range

Returns the error Error in 'rangemap' command: Invalid range: '0—1800'. '-' expected. because of the Em dash http://www.thepunctuationguide.com/em-dash.html

cheers, MuS

Re: What's wrong with my rangemap?

sloshburch — Thu, 15 Oct 2015 20:29:16 GMT

Also, depending on permissions, you may need to add indexes=* to your first line.

For example, you could go so far as starting with the new line:

| metadata type=hosts ( index=* OR index=_* )