Splunk Search

How can I display ranges as text min - max?

grantsmiley
Path Finder

If I have data such as this:
SensorNo A B C D....Z AA AB....
123 2.4 2.5 2.6 1.0 ....89.1
124 8.6 2.6 3.6 5.7 ....
125 5.6 2.55 4.6 12.1....

And I want a table that shows the ranges of each value, such as in:

 | stats min(A) as minA max(A) as  maxA|eval rangeA=min(A)+" to "+maxA

Would look like:

minA    maxA     rangeA
2.4        8.6         2.6 to 8.6 

I do not know how many fields are going to be in this data set in advance but I want that range for all of them, A thru however many there are. Doing that stats naming and eval isn't going to work because I can't predefine how many fields there are. I found I can get the min, max, and max-min using:

 |stats min() max() range() 

However, this results in 3x the number of fields I want and a goofy sort of the columns.

The ultimate goal is to drop the fields min(A) max(A) and just display the range in the human readable form "2.6 to 8.6"
|stats.... |fields - min() max()
or something like that

Thanks in advance

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

You need foreach command here to dynamically process fields.

your current search giving fields: SensorNo A B C D....Z AA AB.... 
| stats min(*) as min* max(*) as max*
| foreach min* [| eval "range<<MATCHSTR>>"='max<<MATCHSTR>>'." to ".'min<<MATCHSTR>>' ]
| table range*

View solution in original post

0 Karma

somesoni2
Revered Legend

You need foreach command here to dynamically process fields.

your current search giving fields: SensorNo A B C D....Z AA AB.... 
| stats min(*) as min* max(*) as max*
| foreach min* [| eval "range<<MATCHSTR>>"='max<<MATCHSTR>>'." to ".'min<<MATCHSTR>>' ]
| table range*
0 Karma

grantsmiley
Path Finder

That works beautifully... thank you. I'm not sure why, but I will have to read about that part.

0 Karma

grantsmiley
Path Finder

Another query that describes what I want, but this one doesn't work:
|stats min() as min* max() as max* by Spread |eval range*=max*-min*

gives an error on the eval piece, stats part works well.

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

I think you have your syntax incorrect. Try:

| stats min(*) as min* by Spread

I'm not sure about the eval portion, but start with this for now. I can test the other bit out later.

0 Karma

grantsmiley
Path Finder

It works with or without the * inside the min() parenthesis, splunk documentation for aggregate functions indicates to not use the star so I didn't. That part works fine, the range piece is what I haven't been able to figure out.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...