Splunk Search

Is it possible to replace a number with letter grade in dashboard?

wlandymore
New Member

I have created a dashboard that shows a single number based on the vulnerabilities in a group of devices. I'm wondering if there is a way to use something like an if/else statement in Splunk based on that search that is returning the number, to show a letter grade for it.

So if there was a scheme like: 0-10 = A, 11-20 = B, 21-30 = C, 31-40 = D, >=41 = F, then the number could be pulled out of the original search and then the letter grade substituted based on the value.

Has anyone done something like this before that can help with this?

0 Karma
1 Solution

aohls
Contributor

You could use a case statement here.

|eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)

View solution in original post

0 Karma

wlandymore
New Member

fantastic. I'll give these a shot. Thanks.

0 Karma

aohls
Contributor

You could use a case statement here.

|eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)

View solution in original post

0 Karma

kelz
Engager

Hi wlandymore,

There are two possible search for you to substituted based on the value you want to see.

First: Make use of case statement then *eval the * field name you want to replaced based on the condition you want set.

| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Number= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")

Second: You can just hide the Number field

| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Grade= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
| fields - Number

I hope this help...


Kelz

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!