Dashboards & Visualizations

Rangemap working with decimals in grouping

JYTTEJ
Communicator

I want to group responsetimes into following groups: 0.5-1Sec 1-1.5SEC 1.5-2SEC etc. I have multiplied the seconds with 1000:EVAL MSEC=PRT*1000 as rangemap does not work with decimals.

The rangemap statement looks like this: |Rangemap field=MSEC 0-0.5SEC=0-500 0.5-1SEC=501-1000 1-1.5SEC=1001-1500 1.5-2SEC=1501-2000 2-2.5SEC=2001-2500 default=>2.5SEC

The calculated value of MSEC is in following range: 1004 to 1013, so I expected the result to lie in range: 1-1.5SEC. BUT: The result is >2.5SEC.

If I omit the . decimals like this: |rangemap field=MSEC 0-05SEC=0-500 05-1SEC=501-1000 1-15SEC=1001-1500 15-2SEC=1501-2000 2-25SEC=2001-2500 default=>2.5SEC

Then the result is now: 1-15SEC - which is correct - but I would really like to show it as 1-1.5SEC.

Any good ideas how I obtain this?

Tags (1)
0 Karma
1 Solution

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

View solution in original post

0 Karma

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

0 Karma

JYTTEJ
Communicator

Thank you - this works beautiful!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...