Splunk Search

How to genterate list of data by giving max and min limit?

DS904458
Explorer

Hi,
I need genterate list of data by giving max and min range.
But I can't find a command (function) doing that.

I will set max = 50 and min = 10 for following example.

I think there's two way to do it by giving different argument.
1.
Set max = 50 ,  min = 10,  output amount(length) of data = 7.
Then I will recevice the output like:
[10,   16.66,   23.32,   29.98,   36.64,   43.3,   50]
In this case, I won't need set an interval.
I only need give how many outcome I want to receive.

2.
Set max = 50 ,  min = 10,  interval = 8.1.
Then I will recevice the output like:
[10,   18.1,   26.2,   34.3,   42.4,   50.5]
The last(max data) can received 50 or 50.5, all works for me.
In this case, I won't need set how many data I want to receive.
I only need give the interval.

Both way is aim to receive a list of data.
Personally, I prefer No.1 solution, it is closer my need.

By the way, I hope the output data can be a list or mutivalue.

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval min=10,max=50,count=7
| eval list=mvrange(0,count)
| eval list=mvmap(list,round(min+(list*(max-min)/(count-1)),2))
0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @DS904458,

 

Depending on how you want to use the list of numbers, you may be able to use a macro.

E.g. this search:

index=_internal sourcetype=splunkd
| eval list= `generate_list(50,10,7)`
| makemv list delim=" "
| table _time, sourcetype, list


Returns a list of 7 numbers from 10 to 50 :

danspav_0-1686031943384.png

The macro definition is:

[generate_list(3)]
args = max,min,length
definition = [|makeresults count=$length$\
| streamstats count as id\
|eval value=if(id=1,$min$, round($min$ + (id-1) * (($max$ - $min$) / ($length$ - 1)),1))\
| stats list(value) as value\
| nomv value\
| eval value="\"" . value . "\""\
| return $value]
errormsg = Please only enter numbers for: Max, Min, Length.
iseval = 0
validation = tonumber(max) >0 AND tonumber(min) >-1  AND tonumber(length) >0

 

danspav_1-1686032018707.png


It could also be used as the search for a dropdown on a dashboard, e.g.:

| makeresults
| eval list=`generate_list(50,10,7)`
| makemv list delim=" "
| mvexpand list
| table list


Does that help?

Cheers,
Daniel

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...