Dashboards & Visualizations

Rangemap working with decimals in grouping

JYTTEJ
Communicator

I want to group responsetimes into following groups: 0.5-1Sec 1-1.5SEC 1.5-2SEC etc. I have multiplied the seconds with 1000:EVAL MSEC=PRT*1000 as rangemap does not work with decimals.

The rangemap statement looks like this: |Rangemap field=MSEC 0-0.5SEC=0-500 0.5-1SEC=501-1000 1-1.5SEC=1001-1500 1.5-2SEC=1501-2000 2-2.5SEC=2001-2500 default=>2.5SEC

The calculated value of MSEC is in following range: 1004 to 1013, so I expected the result to lie in range: 1-1.5SEC. BUT: The result is >2.5SEC.

If I omit the . decimals like this: |rangemap field=MSEC 0-05SEC=0-500 05-1SEC=501-1000 1-15SEC=1001-1500 15-2SEC=1501-2000 2-25SEC=2001-2500 default=>2.5SEC

Then the result is now: 1-15SEC - which is correct - but I would really like to show it as 1-1.5SEC.

Any good ideas how I obtain this?

Tags (1)
0 Karma
1 Solution

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

View solution in original post

0 Karma

chris
Motivator

There seems to be a limitation on the characters you can use in the resulting string for the rangemap command. It would be interesting to know if this is an intentional limitation.

You can use this to work around your problem:

|rangemap field=MSEC 0=0-500 1=501-1000 2=1001-1500 3=1501-2000 4=2001-2500 default=5 | eval range = case(range==0,"0-0.5 Sec",range==1,"0.5-1 Sec",range==2,"1-1.5 Sec",range==3,"1.5-2 Sec",range==4,"2-2.5 Sec",range==5,">2.5 Sec")

0 Karma

JYTTEJ
Communicator

Thank you - this works beautiful!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...