Dashboards & Visualizations

using rangemap for +/- infinity

kevintelford
Path Finder

I'd like to use the rangemap feature to say | rangemap field=myDifference low_pos=0-499 med_pos=500-999 high_pos=1000+ low_neg=-499-0 med_neg=-999--500 high_neg=-1000-

Now I can do the negative side or the positive side, making my high value the default, and just looking for the other two. | rangemap field=myDifference low_pos=0-499 med_pos=500-999 default=high_pos

I can also just bastardize it saying | rangemap field=myDifference low_pos=0-499 med_pos=500-999 high_pos=1000-9999999999999 low_neg=-499-0 med_neg=-999--500 high_neg=-9999999999999--1000

But is there any way to do the above setting high_pos to 1000+ and high_neg to -1000- ?

Thanks

Tags (1)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You must be explicit with rangemap. It's a python command, so you could modify it yourself to accommodate this configuration. Alternately, you can use the "case" function in the "eval" command:

... | eval range = case(myDifference < -1000, "high_neg", myDifference < -500, "med_neg", myDifference < 0, "low_neg", myDifference < 500, "low_pos", myDifference < 1000, "med_pos", 1==1, "high_pos")

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

You must be explicit with rangemap. It's a python command, so you could modify it yourself to accommodate this configuration. Alternately, you can use the "case" function in the "eval" command:

... | eval range = case(myDifference < -1000, "high_neg", myDifference < -500, "med_neg", myDifference < 0, "low_neg", myDifference < 500, "low_pos", myDifference < 1000, "med_pos", 1==1, "high_pos")

kevintelford
Path Finder

Awesome. Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...