I'm trying to understand the usage of rangemap and metadata commands in splunk. I have gone through some documentation but haven't got the complete picture of those commands. It would be really helpfull if anyone can provide some information related to those commands.
Hi
Have you tried these Splunk docs?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap
Please go to these docs and let me know you need more understanding.
Thanks
For a good use of metadata
, check out Meta Woot!
app: https://splunkbase.splunk.com/app/2949/
It helps to know this (I think it should be on this page somewhere besides the comment section):
The metadata command is essentially a macro around tstats. For the clueful, I will translate:
The firstTime
field is min(_time)
.
The lastTime
field is max(_time)
.
The recentTime
field is max(_indextime)
.
I commented about this here:
https://answers.splunk.com/answers/567047/metadata-showing-wrong-last-indexed-time.html?childToView=...
As far as rangemap
, again, it helps to translate it to the basic commands that it uses to do what it does. Looking at the examples on the docs page:
Example 1:
... | rangemap field=date_second green=1-30 blue=31-39 red=40-59 default=gray
Is the same as this:
... | eval range=case(
date_second>=1 AND date_second<=30, "green",
date_second>=31 AND date_second<=39, "blue",
date_second>=40 AND date_second<=59, "red",
true(), "gray")
Example 2:
... | rangemap field=count low=0-0 elevated=1-100 default=severe
Is the same as this:
... | eval range=case(
count>=0 AND count<=0, "low",
count>=1 AND count<=100, "elevated",
true(), "severe")
Hi
Have you tried these Splunk docs?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap
Please go to these docs and let me know you need more understanding.
Thanks
@kamlesh_vaghela, I think you posted it too fast... You have provided a link to Metasearch
instead of metadata
command
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Metadata
@niketnilay, ooh, my mistake. Answer updated.
Thanks for the correction.