rangemap does not work with decimals?

[briang67]

Hello,

I'm trying to get a rangemap command to work like the below.

| rangemap field=count low=0-.5 elevated=.5-1.5 default=severe

I'm getting an Invalid range: '0-.5'.'- expected.

Will the function not work with a number with a decimal in it? If I replace with whole numbers - like low=0-1 elevated=2-4, it works correctly.

Thanks

[Lowell · Accepted solution]

Update: As of Splunk 6.0 (possibly sooner), the rangemap command does support decimal values.

---

Yeah, decimals are not supported, which is funny since the underlying code uses "float"s, but the matching regex doesn't allow for a leading "." (dot), which is why you get the "Invalid range" message. From what I'm seeing, it seems like this would be a fairly trivial feature request; if you want this feature please open a support ticket with splunk.

That said, you can very easily use a case eval statement instead. Something like this should do the trick for you:

| eval range=case(count<0.5, "low", count<1.5, "elevated", 0==0, "severe")

It appears that the rangemap command allows for overlapping ranges, but the work-around given here does not. I doubt this will be a problem for you.

[briang67]

Thanks for the response - I opened an enhancement request.