Is it possible to replace a number with letter grade in dashboard?

[wlandymore]

I have created a dashboard that shows a single number based on the vulnerabilities in a group of devices. I'm wondering if there is a way to use something like an if/else statement in Splunk based on that search that is returning the number, to show a letter grade for it.

So if there was a scheme like: 0-10 = A, 11-20 = B, 21-30 = C, 31-40 = D, >=41 = F, then the number could be pulled out of the original search and then the letter grade substituted based on the value.

Has anyone done something like this before that can help with this?

[wlandymore]

fantastic. I'll give these a shot. Thanks.

[aohls · Accepted solution]

You could use a case statement here.

|eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)

[kelz]

Hi wlandymore,

There are two possible search for you to substituted based on the value you want to see.

First: Make use of case statement then *eval the * field name you want to replaced based on the condition you want set.

| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Number= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")

Second: You can just hide the Number field

| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Grade= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
| fields - Number

I hope this help...

---

Kelz