Dashboards & Visualizations

Rangemap with String Values

aleem
SplunkTrust
SplunkTrust

I want to use a rangemap to create a single value panel. The issue is that the field I want to colur hold string values (e.g. "Colour_1", "Colour_2" or "Colour_3")

rangemap requires numbers. Is there a way to fiddle with the strings to get them to work with rangemap?

sourcetype="ANM_UK_Grocery" fldDX="DX_1" fldBank="Bank_1" | head 1 | table fldColour,fldBank,fldDX | rangemap fldColour=Color low="Colour_1" severe="Colour_2" elevated="Colour_3"

Be the best version of you
Tags (1)
0 Karma
1 Solution

aleem
SplunkTrust
SplunkTrust

I used the following command to change Colour_1 to 1

eval fldColour=replace(fldColour, "Colour_", "")

Works fine

Be the best version of you

View solution in original post

swaraj_appala
Engager

You can use |eval range=case(..) to deal with strings

Example:
|eval range=case(fldColor=="green", "low", 1==1, "severe")

0 Karma

aleem
SplunkTrust
SplunkTrust

I used the following command to change Colour_1 to 1

eval fldColour=replace(fldColour, "Colour_", "")

Works fine

Be the best version of you
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...