How to use a lookup table to find a value within a range?

[jdomar]

My static lookup table has 3 columns titled Low, High and Name. When I run a search in splunk and extract a field value I want to reference the lookup table and find the row where the value is between Low and High (inclusive) and return Name. I can look for a match to a Low value or a High value but do not know how to look for a value between Low and High. Any help would be greatly appreciated. Thanks in advance.

[deejaybags]

I know this is an older question, but I found it when looking at a similar situation. The rangemap command could not be used as the specs required that the threshold be able to be set outside of Splunk via a CSV file.

I thought of going the opposite way, looking up the threshold via it's alert level and seeing if that alert is valid.

...
| eval temp_alarm_level = "Low"
| lookup alarm_table alarm_level AS temp_alarm_level OUTPUT alarm_threshold AS temp_alarm_threshold
| eval real_alarm_level = if ( my_alarm_threshold >= temp_alarm_threshold , temp_alarm_level , null )
| eval temp_alarm_level = "Mid"
| lookup alarm_table alarm_level AS temp_alarm_level OUTPUT alarm_threshold AS temp_alarm_threshold
| eval real_alarm_level = if ( my_alert_threshold >= temp_alarm_threshold , temp_alarm_level , real_alarm_level )
| eval temp_alarm_level = "High"
| lookup alarm_table alarm_level AS temp_alarm_level OUTPUT alarm_threshold AS temp_alarm_threshold
| eval real_alarm_level = if ( my_alarm_threshold >= temp_alarm_threshold , temp_alarm_level , real_alarm_level )
| eval alarm_level = temp_alarm_level
| table alarm_level

Where lookup table "alarm_table" is like :

| alarm_level | alarm_threshold |
| Low         | 1               |
| Mid         | 2               |
| High        | 3               |

my_alarm_threshold is the value you are checking to see if the alert should be raised.

The Low level alert is checked first, then Mid, and finally High. If there is no alert to be raised, the alarm_level field will be null.

Splunk will only return a result if there is an alarm to raise, which is handy when setting up alerts.

This works, but also seams a bit clunky to me, as it is doing 3 lookups.

[chris]

Have you had a look at the rangemap comand?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap

You might be able to achieve what u want using it if your lookup table is not very big:

...| rangemap field=xy name1=0-0 name2=1-100 name3=101-10000 default=severe

Splunk will put the names into the 'range' field