How to replace a field's contents based on their number?

[GenericSplunkUs]

I'm trying to replace the contents of a field to the severity based on the number (I.E. 0 to 19 with Low, 20 to 39 with Medium).

The field can have the numbers 1 to 99 in them and I want the output to display the severity in text.

Low (0 to 19),
Medium (20 to 39),
High (40 to 59),
Critical (60 to 79),
Emergency (80 to 99)

I've tried rex=Severity mode=sed "s/1/Low/g" and it'll work but I need to do a range from 0 to 19. All 99 in a rex style goes over the allowed search characters.

How would I achieve this?

[richgalloway · Accepted solution]

Check out the rangemap command.

... | rangemap field=Severity Low=0-19 Medium=20-39 High=40-50 Critical=60-79 Emergency=80-99 | table range

[GenericSplunkUs]

Worked perfectly, Thank you.