Splunk Search

How do you use the rangemap and metadata commands in Splunk?

pavanae
Builder

I'm trying to understand the usage of rangemap and metadata commands in splunk. I have gone through some documentation but haven't got the complete picture of those commands. It would be really helpfull if anyone can provide some information related to those commands.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust
0 Karma

woodcock
Esteemed Legend

For a good use of metadata, check out Meta Woot! app: https://splunkbase.splunk.com/app/2949/
It helps to know this (I think it should be on this page somewhere besides the comment section):

The metadata command is essentially a macro around tstats. For the clueful, I will translate:
The firstTime field is min(_time).
The lastTime field is max(_time).
The recentTime field is max(_indextime).

I commented about this here:
https://answers.splunk.com/answers/567047/metadata-showing-wrong-last-indexed-time.html?childToView=...

As far as rangemap, again, it helps to translate it to the basic commands that it uses to do what it does. Looking at the examples on the docs page:
Example 1:

... | rangemap field=date_second green=1-30 blue=31-39 red=40-59 default=gray

Is the same as this:

... | eval range=case(
      date_second>=1 AND date_second<=30, "green",
      date_second>=31 AND date_second<=39, "blue",
      date_second>=40 AND date_second<=59, "red",
      true(), "gray")

Example 2:

... | rangemap field=count low=0-0 elevated=1-100 default=severe

Is the same as this:

... | eval range=case(
      count>=0 AND count<=0, "low",
      count>=1 AND count<=100, "elevated",
      true(), "severe")

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi
Have you tried these Splunk docs?

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap

Please go to these docs and let me know you need more understanding.

Thanks

0 Karma

niketn
Legend

@kamlesh_vaghela, I think you posted it too fast... You have provided a link to Metasearch instead of metadata command

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

kamlesh_vaghela
SplunkTrust
SplunkTrust

@niketnilay, ooh, my mistake. Answer updated.
Thanks for the correction.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...