I have a lookup file containing this sort of data Field Interval Scores FieldName 0,15,30,60,300,3600 5,4,3,2,1,0 What I am doing is to look at a field value 'MedDelta' and working ...
See more...
I have a lookup file containing this sort of data Field Interval Scores FieldName 0,15,30,60,300,3600 5,4,3,2,1,0 What I am doing is to look at a field value 'MedDelta' and working out in which range of Interval values it sits between and assigning it the corresponding Score value from the Score field like this | lookup scores.csv Field
| eval Interval=split(Interval,","), Scores=split(Scores,",")
| eval ind=mvmap(Interval, if(MedDelta<=Interval,1,0))
| eval ScoreCount=mvcount(Scores) - 1
| eval t=mvfind(ind,"1"), Score=if(isnull(t), mvindex(Scores, ScoreCount, ScoreCount), mvindex(Scores,t-1,t-1)) So, if I have MedDelta=10, then Score is 5 (range 0-15), MedDelta is 93, then Score is 2 (range 60-300). However, mvmap is Splunk 8 and I need to deploy this to Splunk 7.4. I cannot use mvexpand Anyone know some cool Splunk trickery to do the same thing without mvmap?