Dashboards & Visualizations

Can you help me with an issue with the rangemap command?

roopeshetty
Path Finder

Hi,

We have a field by name “Scores”, which has values in numbers that vary from -99 to 399. Now we need to run a “rangemap” query on them so that we can categorize them as below;

-99 to 1=Poor
2 to 150=Average
151 to 200=Good
201 to 399=Excellent

We are running the query as something like this, but it is not working as expected;

| rangemap field= Scores Poor=-99-1 Average=2-150 Good=151-200 default=Excellent

Can someone tell us what’s wrong with this above query?

0 Karma

knielsen
Contributor

If this is cut and paste from your actual query, lose the space between field= and Scores. 🙂

woodcock
Esteemed Legend

You can make your own rangemap command with eval like this:

... | eval range = case(Scores<-99, "Excellent", Scores<=1,"Poor",  Scores<=150, "Average", Scores<=200, "Good", true(), "Excellent")

roopeshetty
Path Finder

its skipping the values which are less than 1.. any other way?

0 Karma

woodcock
Esteemed Legend

I have updated my answer to more accurately match.

0 Karma

roopeshetty
Path Finder

hi ,
now getting error as "Unbalanced quotes"

0 Karma

woodcock
Esteemed Legend

Fixed one more typo. Good to go now.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...