Deployment Architecture

Creating clusters from intervals of numeric values

SilviaGebel
Path Finder

Hi everyone

I want to create clusters of numeric data.

For example:

field: temperature with values between 19.0°C and 23.0°C

the clusters should be as following:

temp1: 19.0 - 21.0
temp2: 21.1 - 22.0
temp3: 22.1 - 23.0

I would need to have a search string as such: |eval temp1=(temperature>="19.0" AND "temperature<="21.0")

so I can search for | chart list(error) by temp*

in order to see how many times an error occured in each of the temperature intervalls.

Tags (3)
0 Karma
1 Solution

aweitzman
Motivator

To do a chart that is subdivided by temperature clusters, what you want to do is create one field (let's call it temprange) with different values. That way you can use | stats list(error) by temprange to get what you want.

...your search for data...
| eval temprange=case(temperature>=19 AND temperature<=21,"low",temperature>21 AND temperature<=22,"medium",temperature>22 AND temperature<=23,"high",1=1,"out of range")
| stats list(error) as Errors count by temprange

(Assuming that the temperature field is numeric; you don't want to compare numbers using strings as you've listed above. If not, use the convert function on it: | convert auto(temperature) before doing the eval/case statement.)

View solution in original post

0 Karma

aweitzman
Motivator

To do a chart that is subdivided by temperature clusters, what you want to do is create one field (let's call it temprange) with different values. That way you can use | stats list(error) by temprange to get what you want.

...your search for data...
| eval temprange=case(temperature>=19 AND temperature<=21,"low",temperature>21 AND temperature<=22,"medium",temperature>22 AND temperature<=23,"high",1=1,"out of range")
| stats list(error) as Errors count by temprange

(Assuming that the temperature field is numeric; you don't want to compare numbers using strings as you've listed above. If not, use the convert function on it: | convert auto(temperature) before doing the eval/case statement.)

0 Karma

SilviaGebel
Path Finder

This is perfect! Thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...