Hello,
I need some help. I'm trying to make a search where I take recipient_count and assign a "value" based on how many recipients there are. For example, recipient_count greater than or equal to 25 value=5, recipient_count range is between 50-99 value=7, recipient_count greater than or equal to 100 value=9
Any ideas how I could accomplish this?
Thanks in advance!
try something like below,
| your base search
| eval value=case(recipient_count>=25 AND recipient_count<=50 ,5,recipient_count>50 AND recipient_count<=99,7,recipient_count>=100,9)
@thambisetty thanks!
Check out the rangemap
command:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap
try something like below,
| your base search
| eval value=case(recipient_count>=25 AND recipient_count<=50 ,5,recipient_count>50 AND recipient_count<=99,7,recipient_count>=100,9)