Splunk Search

Using parameters in rangemap

stefano_guidoba
Communicator

Hi,

what I want to achieve is a dynamic (datetime based) rangemap of an application's exceptions. So, instead of terminating my search with a simple

... | rangemap low=0-100 elevated=101-200 default=severe

I would rather something like that:

... | rangemap low=0-thr elevated=thr-2*thr default=severe

where thr is a value extracted from a lookup table. Is this possible?
Regards,

Stefano

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Rangemap only takes explicit integers. However, rangemap basically only is shorthand for case:

... | eval range = case(field < low_threshold, "low", field < elevated_threshold, "elevated", field >= elevated_threshold, "severe")

Note, this is not exactly the same as the first rangemap you quote - negative values get the default from rangemap but low from this case. Just take care to specify the case conditions accurately to match your requirements.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Rangemap only takes explicit integers. However, rangemap basically only is shorthand for case:

... | eval range = case(field < low_threshold, "low", field < elevated_threshold, "elevated", field >= elevated_threshold, "severe")

Note, this is not exactly the same as the first rangemap you quote - negative values get the default from rangemap but low from this case. Just take care to specify the case conditions accurately to match your requirements.

stefano_guidoba
Communicator

Hi Martin,

in the end I did exactly what you suggested encasing the eval command in a macro. Thanks for your suggestion,
regards

Stefano

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...