Dashboards & Visualizations

Rangemap working with decimals in grouping

JYTTEJ
Communicator

I want to group responsetimes into following groups: 0.5-1Sec 1-1.5SEC 1.5-2SEC etc. I have multiplied the seconds with 1000:EVAL MSEC=PRT*1000 as rangemap does not work with decimals.

The rangemap statement looks like this: |Rangemap field=MSEC 0-0.5SEC=0-500 0.5-1SEC=501-1000 1-1.5SEC=1001-1500 1.5-2SEC=1501-2000 2-2.5SEC=2001-2500 default=>2.5SEC

The calculated value of MSEC is in following range: 1004 to 1013, so I expected the result to lie in range: 1-1.5SEC. BUT: The result is >2.5SEC.

If I omit the . decimals like this: |rangemap field=MSEC 0-05SEC=0-500 05-1SEC=501-1000 1-15SEC=1001-1500 15-2SEC=1501-2000 2-25SEC=2001-2500 default=>2.5SEC

Then the result is now: 1-15SEC - which is correct - but I would really like to show it as 1-1.5SEC.

Any good ideas how I obtain this?

Tags (1)
0 Karma
1 Solution

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

View solution in original post

0 Karma

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

0 Karma

JYTTEJ
Communicator

Thank you - this works beautiful!

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...