I am trying to group range of decimal number: Range between 10.0.0 and10.15 =Medium
10.16 -11=High
11.1-11.5=critical
for example:
Severity
10.15.4 12.6 12.6.0
10.15.7
10.15.7 10.15.7 12.6 12.6
10.15.7 12.5.1 12.6 12.6.0
10.15.7 12.6 12.6.0
11.0 12.5.1
11.0 12.6 12.6.0
11.0.1 12.3.1 12.6 12.6.0
11.2 12.6 12.6.0
11.2.3 11.6.3 12.2.1 12.6 12.6.0
11.2.3 12.6 12.6.0
11.4 12.5.1
11.4 12.5.1 12.5.1 12.6 12.6
11.4 12.6 12.6.0
11.5.1 12.6 12.6.0
11.5.2 11.6.2 12.6 12.6.0
11.5.2 11.7 11.7.0
11.5.2 12.2.1 12.5.1
11.5.2 12.2.1 12.6 12.6.0
11.5.2 12.6 12.6.0
11.6 11.6.0
11.6 11.6.2 12.2.1 12.6 12.6.0
11.6 11.6.2 12.3.1
Try something like this
your base search
| eval OS_Name=case(match('Base MAC OS',"10\..*"),"Catalina", match('Base MAC OS',"11\..*"),"Big Sur",match('Base MAC OS',"12\..*"),"Monterey", true(),"Unknown")
There may be other ways to do this, but here's one. It converts the version strings into integers, which are easy to compare or test in ranges.
...
| eval versint = split(version, ".")
```We use separate fields because printf won't accept mvindex as an argument```
| eval major=mvindex(versint, 0), minor=mvindex(versint,1), maint=mvindex(versint,2)
```Handle missing 3rd-level number```
| fillnull value=0 maint
| eval versint = printf("%02d%02d%02d", major, minor, maint)
...
This assume each level of the version string can be a 2-digit number. Feel free to adjust the printf format to allow for 3-digit number, if necessary.
A sequence of characters with more than one decimal point is not a number so Splunk will not treat it as such.
What problem are you trying to solve?
I am trying to restructure a data for this purpose
For all MAC OS between 10.15 and 10.99 = Catalina
For all MAC OS between 11:00 to 11:99 = Big Sur
For all MAC OS between 12:00 to 12:99 = Monterey
Field name is:
Base MAC OS
10.15.4
10.15.7
11.0
11.0.1
11.2
11.2.3
11.3.1
11.4
11.5.1
11.5.2
11.6
11.6.1
11.6.2
11.6.3
11.6.4
11.6.5
11.6.6
11.6.7
11.6.8
11.7
12.0.1
12.1
12.2
12.2.1
12.3
12.3.1
12.4
12.5
12.5.1
12.6