Splunk Search

## Is it possible to replace a number with letter grade in dashboard?

New Member

I have created a dashboard that shows a single number based on the vulnerabilities in a group of devices. I'm wondering if there is a way to use something like an if/else statement in Splunk based on that search that is returning the number, to show a letter grade for it.

So if there was a scheme like: 0-10 = A, 11-20 = B, 21-30 = C, 31-40 = D, >=41 = F, then the number could be pulled out of the original search and then the letter grade substituted based on the value.

Has anyone done something like this before that can help with this?

Tags (4)
1 Solution
Contributor

You could use a case statement here.

``````|eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)
``````
New Member

fantastic. I'll give these a shot. Thanks.

Contributor

You could use a case statement here.

``````|eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)
``````
Explorer

Hi wlandymore,

There are two possible search for you to substituted based on the value you want to see.

First: Make use of case statement then *eval the * field name you want to replaced based on the condition you want set.

``````| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Number= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
``````

Second: You can just hide the Number field

``````| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Grade= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
| fields - Number
``````

I hope this help...

Kelz

Get Updates on the Splunk Community!

#### .conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

#### ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

#### Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...