Splunk Search

How to genterate list of data by giving max and min limit?

DS904458
Explorer

Hi,
I need genterate list of data by giving max and min range.
But I can't find a command (function) doing that.

I will set max = 50 and min = 10 for following example.

I think there's two way to do it by giving different argument.
1.
Set max = 50 ,  min = 10,  output amount(length) of data = 7.
Then I will recevice the output like:
[10,   16.66,   23.32,   29.98,   36.64,   43.3,   50]
In this case, I won't need set an interval.
I only need give how many outcome I want to receive.

2.
Set max = 50 ,  min = 10,  interval = 8.1.
Then I will recevice the output like:
[10,   18.1,   26.2,   34.3,   42.4,   50.5]
The last(max data) can received 50 or 50.5, all works for me.
In this case, I won't need set how many data I want to receive.
I only need give the interval.

Both way is aim to receive a list of data.
Personally, I prefer No.1 solution, it is closer my need.

By the way, I hope the output data can be a list or mutivalue.

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval min=10,max=50,count=7
| eval list=mvrange(0,count)
| eval list=mvmap(list,round(min+(list*(max-min)/(count-1)),2))
0 Karma

danspav
SplunkTrust
SplunkTrust

Hi @DS904458,

 

Depending on how you want to use the list of numbers, you may be able to use a macro.

E.g. this search:

index=_internal sourcetype=splunkd
| eval list= `generate_list(50,10,7)`
| makemv list delim=" "
| table _time, sourcetype, list


Returns a list of 7 numbers from 10 to 50 :

danspav_0-1686031943384.png

The macro definition is:

[generate_list(3)]
args = max,min,length
definition = [|makeresults count=$length$\
| streamstats count as id\
|eval value=if(id=1,$min$, round($min$ + (id-1) * (($max$ - $min$) / ($length$ - 1)),1))\
| stats list(value) as value\
| nomv value\
| eval value="\"" . value . "\""\
| return $value]
errormsg = Please only enter numbers for: Max, Min, Length.
iseval = 0
validation = tonumber(max) >0 AND tonumber(min) >-1  AND tonumber(length) >0

 

danspav_1-1686032018707.png


It could also be used as the search for a dropdown on a dashboard, e.g.:

| makeresults
| eval list=`generate_list(50,10,7)`
| makemv list delim=" "
| mvexpand list
| table list


Does that help?

Cheers,
Daniel

 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...