Splunk Search

Using parameters in rangemap

stefano_guidoba
Communicator

Hi,

what I want to achieve is a dynamic (datetime based) rangemap of an application's exceptions. So, instead of terminating my search with a simple

... | rangemap low=0-100 elevated=101-200 default=severe

I would rather something like that:

... | rangemap low=0-thr elevated=thr-2*thr default=severe

where thr is a value extracted from a lookup table. Is this possible?
Regards,

Stefano

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Rangemap only takes explicit integers. However, rangemap basically only is shorthand for case:

... | eval range = case(field < low_threshold, "low", field < elevated_threshold, "elevated", field >= elevated_threshold, "severe")

Note, this is not exactly the same as the first rangemap you quote - negative values get the default from rangemap but low from this case. Just take care to specify the case conditions accurately to match your requirements.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Rangemap only takes explicit integers. However, rangemap basically only is shorthand for case:

... | eval range = case(field < low_threshold, "low", field < elevated_threshold, "elevated", field >= elevated_threshold, "severe")

Note, this is not exactly the same as the first rangemap you quote - negative values get the default from rangemap but low from this case. Just take care to specify the case conditions accurately to match your requirements.

View solution in original post

stefano_guidoba
Communicator

Hi Martin,

in the end I did exactly what you suggested encasing the eval command in a macro. Thanks for your suggestion,
regards

Stefano

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.