To use the range map functionality, a map definition must have exactly one key column and the key column must be of type NumberRange. If there are any other key columns, or the key column is of a different type, the mapping service will not consider the map a range map.
To create a range map, select a single column to be the key of the map and select NumberRange as the type of the column. The format of the data in a column of type NumberRange must be "m-n", where m is the minimum number in the range and n is the maximum number in the range (i.e., 10-200). The maximum number in the range is not included in the range (i.e., [m,n)). This means a range of 10-200 will only key off numbers equal to 10 to 199. An example set of data is with the first column as the key:
1-2,AA
2-4,AA
4-12,BB
10-20,BB
30-31,BB
100-200,AA
110-120,CC
The example table gets transformed to:
An example event configuration on the above map may look like:
Where CustomerVar97 is expected to contain a numeric value (or is of a type that can be converted to a numeric value, such as an IP or Date).
When performing lookups into the example range map, the value in CustomerVar97 will take the range map and search for the range that the value belongs in (if any). Some examples and their results are:
CustomerVar97 = 1; CustomerVar89 will be set to AA
CustomerVar97 = 4; CustomerVar89 will be set to BB
CustomerVar97 = 300; CustomerVar89 will not be set
Internally, Sentinel converts IP addresses and dates to an integer for tags of the type IPv4 and Date.
IPv4 tags are:
DestinationIP (dip)
SourceIP (sip)
Date tags are:
CustomerVar11 to CustomerVar20 (cv11 to cv20)
DateTime (dt)
ReservedVar11 to ReservedVar20 (rv11 to rv20)
DeviceEventTime
SentinelProcessTime
BeginTime
EndTime
For more information on meta-tags, refer to Collector and Sentinel Meta-tags in Sentinel Reference Guide.
For example, for the table below, column 1 is numerical range equivalent to an IP range of 10.0.0.0 to 10.0.2.255.
167772160-167772415,AAA
167772416-167772671,BBB
167772672-167772927,CCC
Using the same setup as the previous example, if:
the Event Tag is set to DestinationIP and key column set to column 1 (range)
Map Column to column 2 (value). The output values for CustomerVar89.
If an event contains a destination IP of 10.0.1.14 (equivalent to numerical value of 167772430), the output for column CustomerVar89 within the event would be BBB.
Sentinel supports the following number ranges:
Range from negative number to negative number (e.g., "-234--34")
Range from negative number to positive number (e.g., "-234-34")
Range from positive number to positive number (e.g., "234-236")
Single number range (negative) (e.g., "-234"). In this case, the min and the max will both be -234.
Single number range (positive) (e.g., "234"). In this case, the min and the max will both be 234.
Range from negative number to max number (e.g., "-234-"). In this case, the min will be -234 and the max will be (2^63 - 1).
Range from positive number to max number (e.g., "234-"). In this case, the min will be 234 and the max will be (2^63 - 1).
NOTE: In all cases, the min must be less than or equal to the max (e.g., "-234--235" is NOT valid).