topic Re: How do you use the rangemap and metadata commands in Splunk? in Splunk Search

How do you use the rangemap and metadata commands in Splunk?

pavanae — Tue, 28 Nov 2017 00:21:28 GMT

I'm trying to understand the usage of rangemap and metadata commands in splunk. I have gone through some documentation but haven't got the complete picture of those commands. It would be really helpfull if anyone can provide some information related to those commands.

Re: How do you use the rangemap and metadata commands in Splunk?

kamlesh_vaghela — Tue, 28 Nov 2017 07:12:02 GMT

Hi
Have you tried these Splunk docs?

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap

Please go to these docs and let me know you need more understanding.

Thanks

Re: How do you use the rangemap and metadata commands in Splunk?

niketn — Tue, 28 Nov 2017 10:21:42 GMT

@kamlesh_vaghela, I think you posted it too fast... You have provided a link to Metasearch instead of metadata command

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

Re: How do you use the rangemap and metadata commands in Splunk?

kamlesh_vaghela — Tue, 28 Nov 2017 10:46:32 GMT

@niketnilay, ooh, my mistake. Answer updated.
Thanks for the correction.

Re: How do you use the rangemap and metadata commands in Splunk?

woodcock — Tue, 28 Nov 2017 18:14:50 GMT

For a good use of metadata, check out Meta Woot! app: https://splunkbase.splunk.com/app/2949/
It helps to know this (I think it should be on this page somewhere besides the comment section):

The metadata command is essentially a macro around tstats. For the clueful, I will translate:
The firstTime field is min(_time).
The lastTime field is max(_time).
The recentTime field is max(_indextime).

I commented about this here:
https://answers.splunk.com/answers/567047/metadata-showing-wrong-last-indexed-time.html?childToView=567064#answer-567064

As far as rangemap, again, it helps to translate it to the basic commands that it uses to do what it does. Looking at the examples on the docs page:
Example 1:

... | rangemap field=date_second green=1-30 blue=31-39 red=40-59 default=gray

Is the same as this:

... | eval range=case(
      date_second>=1 AND date_second<=30, "green",
      date_second>=31 AND date_second<=39, "blue",
      date_second>=40 AND date_second<=59, "red",
      true(), "gray")

Example 2:

... | rangemap field=count low=0-0 elevated=1-100 default=severe

Is the same as this:

... | eval range=case(
      count>=0 AND count<=0, "low",
      count>=1 AND count<=100, "elevated",
      true(), "severe")