When using the rangemap command, how do I determine the order in which ranges display in tables and charts?

[mattness]

When you have a set of events that share a field with a numeric value, you can group those events together according to various ranges of that value. For example, you could have a set of fields with that share SRTime, a field that measures service response time, and which has values ranging between 0 and 1200 ms. Assuming you've already extracted the SRTime field, you can use the rangemap command to break the potential ranges down into groups like so:

    sourcetype=ApplicationLog SRTime="*" 
    | rangemap field=SRTime Great=1-200 Good=201-400 Acceptable 401-600 default=Slow 
    | stats count by range 

This adds a new field to your events called "range" and then gives it a value according to the numeric value of "SRTime". The stats command then breaks your events up into groups according to the value of range that they have.

One of the problems that you'll find, however, is that the finished table/chart orders the counts of the "range" field alphabetically. So if you create a column chart from this, you'll see the columns in this order: Acceptable, Good, Great, Slow.

How do you adjust the search so that the columns are ordered according to their range (Great, Good, Acceptable, Slow)?

[mattness · Accepted solution]

To do this, you extend the search by:

• Adding an eval command that introduces a temporary (this search only) order field that is mapped to the range values.
• Sorting on this order field in an ascending order.
• Removing the order field from the resulting table/chart (while keeping the sorting order).

Here's what the amended search looks like after this sorting functionality is included:

   sourcetype=ApplicationLog SRTime="*" 
   | rangemap field=SRTime Great=1-200 Good=201-400 Acceptable 401-600 default=Slow 
   | stats count by range 
   | eval order = if(range="Great",0,if(range="Good",1,if(range="Acceptable",2,3))) 
   | sort + order 
   | fields - order

With this, you can create a column chart with columns labeled "Great," "Good," "Acceptable," and "Slow," in that order from left to right.

For a more detailed version of this rangemap command demonstration, see this topic in the Splunk User Manual.

[aryamehr360]

Thank you.