Splunk Search

rangemap command

RobertRi
Communicator

Hello

I have a question about the rangemap command

In this example, I can define colors for various alert values

| rangemap field=alert green=1-5 red=5-100

is there a way or command to define the same colors with strings except integers like

| rangemap field=alert red="critical" orange="warning" green="ok"

or can I convert this field strings (warning, critical ...) into integers ?

Thanks Robert

ftk
Motivator

Hey Robert, rangemap expects numerical input, as such using strings to define colors will not work. You can however preface rangemapwith eval and convert your strings to integers. Here is an example, using your "alert" field:

| eval alert_level = case(alert=="ok",1,alert=="warning",2,alert=="critical",3) | rangemap field=alert_level green=1 orange=2 red=3
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...