Splunk Search

## Is it possible to replace a number with letter grade in dashboard? New Member

I have created a dashboard that shows a single number based on the vulnerabilities in a group of devices. I'm wondering if there is a way to use something like an if/else statement in Splunk based on that search that is returning the number, to show a letter grade for it.

So if there was a scheme like: 0-10 = A, 11-20 = B, 21-30 = C, 31-40 = D, >=41 = F, then the number could be pulled out of the original search and then the letter grade substituted based on the value.

Has anyone done something like this before that can help with this?

Tags (4)
1 Solution Contributor

You could use a case statement here.

``````|eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)
`````` New Member

fantastic. I'll give these a shot. Thanks. Contributor

You could use a case statement here.

``````|eval risk = case(score <= 10, "A", score > 10 AND score <= 20, "B", score > 20 AND score <= 30......)
`````` Engager

Hi wlandymore,

There are two possible search for you to substituted based on the value you want to see.

First: Make use of case statement then *eval the * field name you want to replaced based on the condition you want set.

``````| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Number= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
``````

Second: You can just hide the Number field

``````| makeresults
| eval Number= "1,3,4,10,15,16,23,28,29,45,46,49"
| makemv delim="," Number
| mvexpand Number
| table Number
| eval Grade= case(Number >= 0 AND Number <= 10, "A", Number >= 11 AND Number <= 20, "B", Number >= 21 AND Number <= 30, "C", 1=1, "D")
| fields - Number
``````

I hope this help...

Kelz Did you miss .conf21 Virtual?

### Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE! Catch Up Now >>

Get Updates on the Splunk Community!