Dashboards & Visualizations

Rangemap working with decimals in grouping

JYTTEJ
Communicator

I want to group responsetimes into following groups: 0.5-1Sec 1-1.5SEC 1.5-2SEC etc. I have multiplied the seconds with 1000:EVAL MSEC=PRT*1000 as rangemap does not work with decimals.

The rangemap statement looks like this: |Rangemap field=MSEC 0-0.5SEC=0-500 0.5-1SEC=501-1000 1-1.5SEC=1001-1500 1.5-2SEC=1501-2000 2-2.5SEC=2001-2500 default=>2.5SEC

The calculated value of MSEC is in following range: 1004 to 1013, so I expected the result to lie in range: 1-1.5SEC. BUT: The result is >2.5SEC.

If I omit the . decimals like this: |rangemap field=MSEC 0-05SEC=0-500 05-1SEC=501-1000 1-15SEC=1001-1500 15-2SEC=1501-2000 2-25SEC=2001-2500 default=>2.5SEC

Then the result is now: 1-15SEC - which is correct - but I would really like to show it as 1-1.5SEC.

Any good ideas how I obtain this?

Tags (1)
0 Karma
1 Solution

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

View solution in original post

0 Karma

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

0 Karma

JYTTEJ
Communicator

Thank you - this works beautiful!

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...