Finds numeric range between the smallest and largest numbers for the specified field over a set of events. Result is returned in a field named _range.

ParameterTypeRequiredDefault ValueDescription
asstringoptional[a] _range Name of output field.
field[b]stringrequired   Field to extract a number from.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

range() Examples

Click + next to an example below to get the full details.

Find Range Between Smallest And Largest Numbers in Field

Find numeric range between the smallest and largest numbers in specified field using the range() function

Query
logscale
range(responsetime)
Introduction

In this example, the range() function is used to find the range of the values in the field responsetime.

Example incoming event data might look like this:

timestampendpointresponsetime
2025-04-30T07:00:00Z/api/users0.125
2025-04-30T07:00:01Z/api/login2.543
2025-04-30T07:00:02Z/api/data0.891
2025-04-30T07:00:03Z/api/users1.234
2025-04-30T07:00:04Z/api/search3.456
2025-04-30T07:00:05Z/api/login0.567
2025-04-30T07:00:06Z/api/data1.789
2025-04-30T07:00:07Z/api/users0.234
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    range(responsetime)

    Finds the range of the values in the field responsetime, and returns the result in a field named _range. The range() function always returns a single number (the difference between maximum and minimum).

  3. Event Result set.

Summary and Results

The query is used to calculate the difference between the highest and lowest values in the field responsetime across a set of events. Finding the range of responsetime in LogScale is particularly useful for performance analysis to identify performance inconsistancies. A small range indicates consistent performance, while a large range suggests reliability issues.

The range() function is commonly used with groupBy() for comparative analysis. See Find Range of CPU Usage by Host.

Sample output from the incoming example data:

_range
3.331

Find Range of CPU Usage by Host

Find numeric range between the smallest and largest numbers in specified field using the range() function with groupBy()

Query
logscale
groupBy([host], function=range(cpu_usage))
Introduction

In this example, the range() function is used to find the CPU usage by host by finding the range of the values in the field cpu_usage.

Example incoming event data might look like this:

timestamphostcpu_usage
2025-04-30T07:00:00Zhost1.com50
2025-04-30T07:01:00Zhost1.com75
2025-04-30T07:02:00Zhost1.com95
2025-04-30T07:03:00Zhost1.com65
2025-04-30T07:00:00Zhost2.com50
2025-04-30T07:01:00Zhost2.com70
2025-04-30T07:02:00Zhost2.com55
2025-04-30T07:03:00Zhost2.com65
2025-04-30T07:00:00Zhost3.com25
2025-04-30T07:01:00Zhost3.com100
2025-04-30T07:02:00Zhost3.com45
2025-04-30T07:03:00Zhost3.com80
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    groupBy([host], function=range(cpu_usage))

    Groups events by host name in the field host ([host]), then calculates the range (the difference) between highest CPU usage value and lowest CPU usage value for each host, returning the results in a new field named _range.

    The range() function always returns a single number (the difference between maximum and minimum).

  3. Event Result set.

Summary and Results

The query is used to find the CPU usage by host. The smaller the range (0-20), the more stable is the system.

Sample output from the incoming example data:

host_range
host1.com45
host2.com20
host3.com75