Dashboards & Visualizations

Can you help me with an issue with the rangemap command?

roopeshetty
Path Finder

Hi,

We have a field by name “Scores”, which has values in numbers that vary from -99 to 399. Now we need to run a “rangemap” query on them so that we can categorize them as below;

-99 to 1=Poor
2 to 150=Average
151 to 200=Good
201 to 399=Excellent

We are running the query as something like this, but it is not working as expected;

| rangemap field= Scores Poor=-99-1 Average=2-150 Good=151-200 default=Excellent

Can someone tell us what’s wrong with this above query?

0 Karma

knielsen
Contributor

If this is cut and paste from your actual query, lose the space between field= and Scores. 🙂

woodcock
Esteemed Legend

You can make your own rangemap command with eval like this:

... | eval range = case(Scores<-99, "Excellent", Scores<=1,"Poor",  Scores<=150, "Average", Scores<=200, "Good", true(), "Excellent")

roopeshetty
Path Finder

its skipping the values which are less than 1.. any other way?

0 Karma

woodcock
Esteemed Legend

I have updated my answer to more accurately match.

0 Karma

roopeshetty
Path Finder

hi ,
now getting error as "Unbalanced quotes"

0 Karma

woodcock
Esteemed Legend

Fixed one more typo. Good to go now.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...