Community:Search Performance: Use Eval Instead of Rangemap

You can achieve the feature Rangemap by eval with case() function. Rangemap is a python script while eval is c binary. So, Most of time eval could be more than four times faster.

#
# Example of rangemap
#

 | rangemap field=date_second green=1-30 blue=31-39 red=40-59 default=gray



#
# Instead of rangemap, use eval <field>=case()
# => Faster
#


index=_internal source="*metrics.log" per_index_thruput 
   | eval range=case(ev <= 50, "-50", ev <= 500,"-500", ev <= 5000, "-5000", ev > 5000, "Others" ) 
   | chart count by series, range

# You can use AND, OR
index=_internal source="*metrics.log" per_index_thruput 
   | eval range=case(ev >= 0 AND ev <= 50, "-50", ev > 50 AND ev <= 500,"-500", ev > 500 AND ev <= 5000, "-5000", ev > 5000, "Others" ) 
   | chart count by series, rang