<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Error in 'where' command becuase of ',' in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671095#M54931</link>
    <description>&lt;P&gt;Technically you could do the following to fix the symptoms&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| where time &amp;gt;= tonmumber(replace($max_value$, ",", "")) - 0.001&lt;/LI-CODE&gt;&lt;P&gt;but you are better off finding the source of the token, as&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231884"&gt;@PickleRick&lt;/a&gt;&amp;nbsp;says, and make sure it contains something suitable to perform calculations with if that's how you intend to use it.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Wed, 06 Dec 2023 22:16:03 GMT</pubDate>
    <dc:creator>bowesmana</dc:creator>
    <dc:date>2023-12-06T22:16:03Z</dc:date>
    <item>
      <title>Error in 'where' command becuase of ','</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/670997#M54924</link>
      <description>&lt;P&gt;When I use my code, I can see this error.&lt;/P&gt;&lt;P&gt;" Error in 'where' command : The operator at ',127.542 - 0.001' is invalid.&lt;/P&gt;&lt;P&gt;The problem code is this.&lt;/P&gt;&lt;PRE&gt;| where time &amp;gt;= $max_value$ - 0.001&lt;/PRE&gt;&lt;P&gt;&amp;nbsp;When I print "max_value"&amp;nbsp; at title, I can see that value is "315,127.542"&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I think the reason this problem occurred is&amp;nbsp; ',' at the max_value.&amp;nbsp;&lt;/P&gt;&lt;P&gt;How could I remove ',' at the max_value?&lt;/P&gt;&lt;P&gt;And If it was not the problem, How could I solve this?&lt;/P&gt;</description>
      <pubDate>Wed, 06 Dec 2023 10:23:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/670997#M54924</guid>
      <dc:creator>Questioner</dc:creator>
      <dc:date>2023-12-06T10:23:45Z</dc:date>
    </item>
    <item>
      <title>Re: Error in 'where' command becuase of ','</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671000#M54925</link>
      <description>&lt;P&gt;OK. The question is where are you getting this token from. Because apparently it's a formatted number which indeed might cause the error.&lt;/P&gt;</description>
      <pubDate>Wed, 06 Dec 2023 11:09:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671000#M54925</guid>
      <dc:creator>PickleRick</dc:creator>
      <dc:date>2023-12-06T11:09:46Z</dc:date>
    </item>
    <item>
      <title>Re: Error in 'where' command becuase of ','</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671095#M54931</link>
      <description>&lt;P&gt;Technically you could do the following to fix the symptoms&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| where time &amp;gt;= tonmumber(replace($max_value$, ",", "")) - 0.001&lt;/LI-CODE&gt;&lt;P&gt;but you are better off finding the source of the token, as&amp;nbsp;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231884"&gt;@PickleRick&lt;/a&gt;&amp;nbsp;says, and make sure it contains something suitable to perform calculations with if that's how you intend to use it.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 06 Dec 2023 22:16:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671095#M54931</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-12-06T22:16:03Z</dc:date>
    </item>
    <item>
      <title>Re: Error in 'where' command becuase of ','</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671101#M54932</link>
      <description>&lt;P&gt;OH..! I get this token at &amp;lt;single&amp;gt; block.&lt;/P&gt;&lt;P&gt;The code for this &amp;lt;signle&amp;gt; block looks like this.&lt;/P&gt;&lt;PRE&gt;&lt;FONT color="#993366"&gt;&amp;lt;single&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt;&amp;lt;title&amp;gt;&lt;/FONT&gt;Max time&lt;FONT color="#993366"&gt;&amp;lt;/title&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;  &lt;FONT color="#993366"&gt;&amp;lt;search&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;   &lt;FONT color="#993366"&gt;&amp;lt;query&amp;gt;&lt;/FONT&gt;index=idx_prd_analysis sourcetype="type:prd_analysis:delay_time" corp="delay"&lt;BR /&gt;    | where (plane_type==1) OR (plane_type==2)&lt;BR /&gt;    | eval total_time = round(takeOff_time - boarding_time, 3)&lt;BR /&gt;    | stats MAX(total_time)&lt;FONT color="#993366"&gt;&amp;lt;/query&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;   &lt;FONT color="#993366"&gt;&amp;lt;earliest&amp;gt;&lt;/FONT&gt;$_time.earliest$&lt;FONT color="#993366"&gt;&amp;lt;/earliest&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;   &lt;FONT color="#993366"&gt;&amp;lt;latest&amp;gt;&lt;/FONT&gt;$_time.latest$&lt;FONT color="#993366"&gt;&amp;lt;/latest&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;  &lt;FONT color="#993366"&gt;&amp;lt;/search&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;option&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;name&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"colorMode"&lt;/FONT&gt;&amp;gt;block&lt;FONT color="#993366"&gt;&amp;lt;/option&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;option&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;name&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"drilldown"&lt;/FONT&gt;&amp;gt;all&lt;FONT color="#993366"&gt;&amp;lt;/option&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;option&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;name&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"height"&lt;/FONT&gt;&amp;gt;154&lt;FONT color="#993366"&gt;&amp;lt;/option&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;option&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;name&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"numberPrecision"&lt;/FONT&gt;&amp;gt;0.000&lt;FONT color="#993366"&gt;&amp;lt;/option&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;option&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;name&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"rangeValues"&lt;/FONT&gt;&amp;gt;[500]&lt;FONT color="#993366"&gt;&amp;lt;/option&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;option&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;name&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"refresh.display"&lt;/FONT&gt;&amp;gt;progressbar&lt;FONT color="#993366"&gt;&amp;lt;/option&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;option&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;name&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"unitPosition"&lt;/FONT&gt;&amp;gt;before&lt;FONT color="#993366"&gt;&amp;lt;/option&amp;gt;&lt;/FONT&gt;&lt;BR /&gt; &lt;FONT color="#993366"&gt;&amp;lt;drilldown&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt;  &amp;lt;set&lt;/FONT&gt; &lt;FONT color="#FF9900"&gt;token&lt;/FONT&gt;=&lt;FONT color="#0000FF"&gt;"max_value"&lt;/FONT&gt;&amp;gt;$click.value$&lt;FONT color="#993366"&gt;&amp;lt;/set&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt; &amp;lt;/drilldown&amp;gt;&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT color="#993366"&gt;&amp;lt;/single&amp;gt;&amp;nbsp;&lt;/FONT&gt;&lt;/PRE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Are there any solution to send max_value as normal format not origin? (Not 123,456 -&amp;gt; Wnat 123456)&lt;/P&gt;</description>
      <pubDate>Thu, 07 Dec 2023 02:19:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671101#M54932</guid>
      <dc:creator>Questioner</dc:creator>
      <dc:date>2023-12-07T02:19:24Z</dc:date>
    </item>
    <item>
      <title>Re: Error in 'where' command becuase of ','</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671199#M54944</link>
      <description>&lt;P&gt;You can use an &amp;lt;eval&amp;gt; statement for your drilldown instead of &amp;lt;set&amp;gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;eval token="max_value"&amp;gt;replace($click.value$, ",", "")&amp;lt;/eval&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 07 Dec 2023 23:05:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671199#M54944</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-12-07T23:05:47Z</dc:date>
    </item>
    <item>
      <title>Re: Error in 'where' command becuase of ','</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671210#M54948</link>
      <description>&lt;P&gt;It work!!!&lt;BR /&gt;Thank you for your help&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 08 Dec 2023 04:24:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Error-in-where-command-becuase-of/m-p/671210#M54948</guid>
      <dc:creator>Questioner</dc:creator>
      <dc:date>2023-12-08T04:24:15Z</dc:date>
    </item>
  </channel>
</rss>

