How do you use the rangemap and metadata commands in Splunk?

[pavanae]

I'm trying to understand the usage of rangemap and metadata commands in splunk. I have gone through some documentation but haven't got the complete picture of those commands. It would be really helpfull if anyone can provide some information related to those commands.

[woodcock]

For a good use of metadata, check out Meta Woot! app: https://splunkbase.splunk.com/app/2949/
It helps to know this (I think it should be on this page somewhere besides the comment section):

The metadata command is essentially a macro around tstats. For the clueful, I will translate:
The firstTime field is min(_time).
The lastTime field is max(_time).
The recentTime field is max(_indextime).

I commented about this here:
https://answers.splunk.com/answers/567047/metadata-showing-wrong-last-indexed-time.html?childToView=...

As far as rangemap, again, it helps to translate it to the basic commands that it uses to do what it does. Looking at the examples on the docs page:
Example 1:

... | rangemap field=date_second green=1-30 blue=31-39 red=40-59 default=gray

Is the same as this:

... | eval range=case(
      date_second>=1 AND date_second<=30, "green",
      date_second>=31 AND date_second<=39, "blue",
      date_second>=40 AND date_second<=59, "red",
      true(), "gray")

Example 2:

... | rangemap field=count low=0-0 elevated=1-100 default=severe

Is the same as this:

... | eval range=case(
      count>=0 AND count<=0, "low",
      count>=1 AND count<=100, "elevated",
      true(), "severe")

[kamlesh_vaghela · Accepted solution]

Hi
Have you tried these Splunk docs?

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap

Please go to these docs and let me know you need more understanding.

Thanks

[niketn]

@kamlesh_vaghela, I think you posted it too fast... You have provided a link to Metasearch instead of metadata command

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata

[kamlesh_vaghela]

@niketnilay, ooh, my mistake. Answer updated.
Thanks for the correction.