Dashboards & Visualizations

Can you help me with an issue with the rangemap command?

roopeshetty
Path Finder

Hi,

We have a field by name “Scores”, which has values in numbers that vary from -99 to 399. Now we need to run a “rangemap” query on them so that we can categorize them as below;

-99 to 1=Poor
2 to 150=Average
151 to 200=Good
201 to 399=Excellent

We are running the query as something like this, but it is not working as expected;

| rangemap field= Scores Poor=-99-1 Average=2-150 Good=151-200 default=Excellent

Can someone tell us what’s wrong with this above query?

0 Karma

knielsen
Contributor

If this is cut and paste from your actual query, lose the space between field= and Scores. 🙂

woodcock
Esteemed Legend

You can make your own rangemap command with eval like this:

... | eval range = case(Scores<-99, "Excellent", Scores<=1,"Poor",  Scores<=150, "Average", Scores<=200, "Good", true(), "Excellent")

roopeshetty
Path Finder

its skipping the values which are less than 1.. any other way?

0 Karma

woodcock
Esteemed Legend

I have updated my answer to more accurately match.

0 Karma

roopeshetty
Path Finder

hi ,
now getting error as "Unbalanced quotes"

0 Karma

woodcock
Esteemed Legend

Fixed one more typo. Good to go now.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...