How to eval fields with decimals?

[marceldera]

I am trying to group range of decimal number: Range between 10.0.0 and10.15 =Medium

10.16 -11=High

11.1-11.5=critical 

for example:

Severity

10.15.4 12.6 12.6.0

10.15.7

10.15.7 10.15.7 12.6 12.6

10.15.7 12.5.1 12.6 12.6.0

10.15.7 12.6 12.6.0

11.0 12.5.1

11.0 12.6 12.6.0

11.0.1 12.3.1 12.6 12.6.0

11.2 12.6 12.6.0

11.2.3 11.6.3 12.2.1 12.6 12.6.0

11.2.3 12.6 12.6.0

11.4 12.5.1

11.4 12.5.1 12.5.1 12.6 12.6

11.4 12.6 12.6.0

11.5.1 12.6 12.6.0

11.5.2 11.6.2 12.6 12.6.0

11.5.2 11.7 11.7.0

11.5.2 12.2.1 12.5.1

11.5.2 12.2.1 12.6 12.6.0

11.5.2 12.6 12.6.0

11.6 11.6.0

11.6 11.6.2 12.2.1 12.6 12.6.0

11.6 11.6.2 12.3.1

[somesoni2]

Try something like this

your base search
| eval OS_Name=case(match('Base MAC OS',"10\..*"),"Catalina", match('Base MAC OS',"11\..*"),"Big Sur",match('Base MAC OS',"12\..*"),"Monterey", true(),"Unknown")

[richgalloway]

There may be other ways to do this, but here's one.  It converts the version strings into integers, which are easy to compare or test in ranges.

...
| eval versint = split(version, ".")
```We use separate fields because printf won't accept mvindex as an argument```
| eval major=mvindex(versint, 0), minor=mvindex(versint,1), maint=mvindex(versint,2)
```Handle missing 3rd-level number```
| fillnull value=0 maint
| eval versint = printf("%02d%02d%02d", major, minor, maint)
...

This assume each level of the version string can be a 2-digit number.  Feel free to adjust the printf format to allow for 3-digit number, if necessary.

[richgalloway]

A sequence of characters with more than one decimal point is not a number so Splunk will not treat it as such.

What problem are you trying to solve?

[marceldera]

I am trying to restructure a data for this purpose 

For all MAC OS  between 10.15  and 10.99 = Catalina

For all MAC OS between 11:00 to 11:99 = Big Sur

For all MAC OS between 12:00 to 12:99 = Monterey

Field name is:

Base MAC OS

10.15.4

10.15.7

11.0

11.0.1

11.2

11.2.3

11.3.1

11.4

11.5.1

11.5.2

11.6

11.6.1

11.6.2

11.6.3

11.6.4

11.6.5

11.6.6

11.6.7

11.6.8

11.7

12.0.1

12.1

12.2

12.2.1

12.3

12.3.1

12.4

12.5

12.5.1

12.6