Dashboards & Visualizations

Rangemap with String Values

SplunkTrust
SplunkTrust

I want to use a rangemap to create a single value panel. The issue is that the field I want to colur hold string values (e.g. "Colour1", "Colour2" or "Colour_3")

rangemap requires numbers. Is there a way to fiddle with the strings to get them to work with rangemap?

sourcetype="ANMUKGrocery" fldDX="DX1" fldBank="Bank1" | head 1 | table fldColour,fldBank,fldDX | rangemap fldColour=Color low="Colour1" severe="Colour2" elevated="Colour_3"

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

I used the following command to change Colour_1 to 1

eval fldColour=replace(fldColour, "Colour_", "")

Works fine

View solution in original post

You can use |eval range=case(..) to deal with strings

Example:
|eval range=case(fldColor=="green", "low", 1==1, "severe")

0 Karma

SplunkTrust
SplunkTrust

I used the following command to change Colour_1 to 1

eval fldColour=replace(fldColour, "Colour_", "")

Works fine

View solution in original post