Splunk Dev

Convert range to set

tcollins93
New Member

How do I convert the string "1-4" to the multi-value field of {1,2,3,4}?

Thank you so much for you help, looking forward to a response

Tags (1)
0 Karma

somesoni2
Revered Legend

Try like this

..your current search | eval multivaluedfield=mvrange(mvindex(split(yourstringfield,"-"),0),mvindex(split(yourstringfield,"-"),1)+1)

DalJeanis
Legend

To break that down into a less efficient but more readable nearly-self-explaining code...

...your current search 
| eval TheRange=split(yourstringfield,"-")
| eval LowEnd=mvindex(TheRange,0)
| eval HighEnd=tonumber(mvindex(TheRange,1))+1
| eval multivaluedfield=mvrange(LowEnd,HighEnd)

The +1 is because mvrange halts when it gets to the high end of the range, not producing a result for that last step. You could use +.00000000001 and it would work the same.

woodcock
Esteemed Legend

You need a tonumber around the HighEnd's call to mvindex.

DalJeanis
Legend

rakken sakken sassafrak mumble mumble... so many languages ... grekkle fraggle morgin frelling foldergarben overloaded operators smekk.... because no, + isn't enough of a clue for splunk...

0 Karma

woodcock
Esteemed Legend

Turnabout is fair play!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...