Splunk Search

Using parameters in rangemap

stefano_guidoba
Communicator

Hi,

what I want to achieve is a dynamic (datetime based) rangemap of an application's exceptions. So, instead of terminating my search with a simple

... | rangemap low=0-100 elevated=101-200 default=severe

I would rather something like that:

... | rangemap low=0-thr elevated=thr-2*thr default=severe

where thr is a value extracted from a lookup table. Is this possible?
Regards,

Stefano

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Rangemap only takes explicit integers. However, rangemap basically only is shorthand for case:

... | eval range = case(field < low_threshold, "low", field < elevated_threshold, "elevated", field >= elevated_threshold, "severe")

Note, this is not exactly the same as the first rangemap you quote - negative values get the default from rangemap but low from this case. Just take care to specify the case conditions accurately to match your requirements.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Rangemap only takes explicit integers. However, rangemap basically only is shorthand for case:

... | eval range = case(field < low_threshold, "low", field < elevated_threshold, "elevated", field >= elevated_threshold, "severe")

Note, this is not exactly the same as the first rangemap you quote - negative values get the default from rangemap but low from this case. Just take care to specify the case conditions accurately to match your requirements.

stefano_guidoba
Communicator

Hi Martin,

in the end I did exactly what you suggested encasing the eval command in a macro. Thanks for your suggestion,
regards

Stefano

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...