What's wrong with my rangemap?

[a212830]

Hi,

I'm trying out some searches learned at .conf. This one is supposed to provide lag info for indexing delays. Unfortunately, I can't get it to work. Any help is appreciated.

| metadata type=hosts   
| eval seconds_lag=(recentTime -lastTime)
| convert ctime(lastTime) as LastTime
| convert ctime(firstTime) as FirstTime
| convert ctime(recentTime) as IndexTime
| rangemap field=seconds_lag low=0-1800 elevated=1801-3600
| fields host,FirstTime,LastTime,IndexTime,seconds_lag,range

[sloshburch]

Also, depending on permissions, you may need to add indexes=* to your first line.

For example, you could go so far as starting with the new line:

| metadata type=hosts ( index=* OR index=_* )

[maciep]

Just a long shot, but did you copy and paste this search from somewhere else? Wondering if maybe the dash is like a long dash or something along those lines. If you typed it out yourself in the search bar, then that shouldn't be a problem.

[MuS]

This the answer, because the Em dash will cause this error. You can test it with the two following searches:

working:

| metadata type=hosts    
 | eval seconds_lag=(recentTime -lastTime)
 | convert ctime(lastTime) as LastTime
 | convert ctime(firstTime) as FirstTime
 | convert ctime(recentTime) as IndexTime
 | rangemap field=seconds_lag low=0-1800 elevated=1801-3600
 | fields host,FirstTime,LastTime,IndexTime,seconds_lag,range

not working:

| metadata type=hosts    
 | eval seconds_lag=(recentTime -lastTime)
 | convert ctime(lastTime) as LastTime
 | convert ctime(firstTime) as FirstTime
 | convert ctime(recentTime) as IndexTime
 | rangemap field=seconds_lag low=0—1800 elevated=1801—3600
 | fields host,FirstTime,LastTime,IndexTime,seconds_lag,range

Returns the error Error in 'rangemap' command: Invalid range: '0—1800'. '-' expected. because of the Em dash http://www.thepunctuationguide.com/em-dash.html

cheers, MuS

[martin_mueller]

Odd - 6.3.0 here.

Try one of the examples from http://docs.splunk.com/Documentation/Splunk/6.1.9/SearchReference/rangemap to narrow it down, if those work then modify from there.

[badrinath_itrs]

The rangemap command works fine with my splunk version 6.2.3 . Alternatively you can try with case statement for your requirement.

[martin_mueller]

That query seems to work for me. What results are you getting that appear wrong?

[a212830]

I get:

Error in 'rangemap' command: Invalid range: '0-1800 elevated=1801-3600'. '-' expected.

I am running Splunk 6.1.9