Dashboards & Visualizations

Rangemap working with decimals in grouping

JYTTEJ
Communicator

I want to group responsetimes into following groups: 0.5-1Sec 1-1.5SEC 1.5-2SEC etc. I have multiplied the seconds with 1000:EVAL MSEC=PRT*1000 as rangemap does not work with decimals.

The rangemap statement looks like this: |Rangemap field=MSEC 0-0.5SEC=0-500 0.5-1SEC=501-1000 1-1.5SEC=1001-1500 1.5-2SEC=1501-2000 2-2.5SEC=2001-2500 default=>2.5SEC

The calculated value of MSEC is in following range: 1004 to 1013, so I expected the result to lie in range: 1-1.5SEC. BUT: The result is >2.5SEC.

If I omit the . decimals like this: |rangemap field=MSEC 0-05SEC=0-500 05-1SEC=501-1000 1-15SEC=1001-1500 15-2SEC=1501-2000 2-25SEC=2001-2500 default=>2.5SEC

Then the result is now: 1-15SEC - which is correct - but I would really like to show it as 1-1.5SEC.

Any good ideas how I obtain this?

Tags (1)
0 Karma
1 Solution

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

View solution in original post

0 Karma

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

0 Karma

JYTTEJ
Communicator

Thank you - this works beautiful!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...