Splunk Search

rangemap command

RobertRi
Communicator

Hello

I have a question about the rangemap command

In this example, I can define colors for various alert values

| rangemap field=alert green=1-5 red=5-100

is there a way or command to define the same colors with strings except integers like

| rangemap field=alert red="critical" orange="warning" green="ok"

or can I convert this field strings (warning, critical ...) into integers ?

Thanks Robert

ftk
Motivator

Hey Robert, rangemap expects numerical input, as such using strings to define colors will not work. You can however preface rangemapwith eval and convert your strings to integers. Here is an example, using your "alert" field:

| eval alert_level = case(alert=="ok",1,alert=="warning",2,alert=="critical",3) | rangemap field=alert_level green=1 orange=2 red=3
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...