Dashboards & Visualizations

Displayed with undefined range while using rangmap in the search query

deepthi5
Path Finder

I have define only <1 <2 ❤️ i don't know from where the first row is picked up can some one help in resolving this.

index=* sourcetype=AMS_samplelog
| search server ="1"
| rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
| stats  count as "Server-1" by range
| appendcols [
    search index=* sourcetype=AMS_samplelog
   | search server ="2"
   | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
   | stats  count as "Server-2" by range]
| appendcols [
   search index=* sourcetype=AMS_samplelog
  | search server ="3"
  | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
  | stats  count as "Server-3" by range]
| appendcols [
   search index=* sourcetype=AMS_samplelog
  | search server ="4"
  | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
  | stats  count as "Server-4" by range]
| appendcols [
   search index=* sourcetype=AMS_samplelog
  | search server ="5"
  | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
  | stats  count as "Server-5" by range]
| appendcols [
    search index=* sourcetype=AMS_samplelog
   | search server ="6"
   | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
   | stats  count as "Server-6" by range]
| appendcols [
    search index=* sourcetype=AMS_samplelog
   | search server ="7"
   | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
   | stats  count as "Server-7" by range]
| appendcols [
    search index=* sourcetype=AMS_samplelog
   | search server ="8"
   | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
   | stats  count as "Server-8" by range]
| appendcols [
    search index=* sourcetype=AMS_samplelog
    | rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
    | stats  count as "Total" by range]
| table range, Server-1, Server-2, Server-3, Server-4, Server-5, Server-6, Server-7, Server-8, Total

This is the result:

range   Server-1    Server-2    Server-3    Server-4    Server-5    Server-6    Server-7    Server-8       Total
           16493       20285       19466       19370       18649       32698       23075       26399      176899
<1          4451        5619        5377        5413        5083        8684        6548        7302       48477
<2            80         275         180         149         164         683         351         390        2272
<3            24          26          34          38          24          64          44          40         294
>3            26          40          28          40          34          54          48          50         320
Tags (2)
0 Karma

woodcock
Esteemed Legend

Try this:

index=* sourcetype=AMS_samplelog
| eval server = "Server-" . server
| rangemap field=Msg_Exec_Time "<1"=0-1 "<2"=1-2 "<3"=2-3 ">3"=3-100
| chart count BY range server
| addtotals row=t col=f
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...