topic Re: Line chart does not display the value zero even after setting the code to use one decimal place in Splunk Search

Line chart does not display the value zero even after setting the code to use one decimal place

marklindo — Fri, 08 Jun 2018 11:12:48 GMT

Hello,

Seeking for any assistance on the issue I am encountering.

Issue: Line chart does not display the value zero even after setting the code to use one decimal place. E.g. a value with 6.7 will display the ".7" after the number but a value with 6.0 only displays 6 in the line chart without the ".0"

Here's a screenshot of the line chart:
![alt text][1]

Here's the code I have created to generate the line chart:
| stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter
| eval HourlyCost = round(('Cost1') / ('Hours'),1)

I'm not sure how this can be addressed so any help would be very much appreciated.

Thank you for assisting.

Ben

Re: Line chart does not display the value zero even after setting the code to use one decimal place

jluo_splunk — Fri, 08 Jun 2018 15:40:41 GMT

Hi Marklindo,

It looks like your search is plotting SumCost1 and SumHours by quarter, but those two fields are not being manipulated to show the first decimal place - you are only manipulating HourlyCost. If you'd like the two lines on the chart (SumCost1 and SumHours) to include the first decimal place, try this..

| stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter 
| eval SumCost1 = round(SumCost1, 1)
| eval SumHours = round(SumHours, 1)
| eval HourlyCost = round(('Cost1') / ('Hours'),1)

Re: Line chart does not display the value zero even after setting the code to use one decimal place

marklindo — Mon, 11 Jun 2018 03:29:13 GMT

Hello Jluo,

Thanks for the response. I apologize but I made a mistake on the code I posted. Here's the correct version of the code:

| stats sum(SumCost1) as SumCost1, sum(SumHours ) as SumHours by Quarter
| eval HourlyCost = round ( ( 'SumCost1' / 'SumHours ' ) ,1 )

You were correct in your assessment that I am plotting SumCost1 and SumHours by Quarter. I did try your suggestion but there were no changes on the output.

Is it safe to conclude that Splunk does not plot the ".0" if the output is a whole number. I did test this theory by rounding to 2 decimal places and got a value of "1.09" (apologies I am having difficulty attaching the screenshot on the reply button) .

Ben

Re: Line chart does not display the value zero even after setting the code to use one decimal place

jluo_splunk — Mon, 11 Jun 2018 15:05:08 GMT

Ben,

I tested on my own env and can confirm that I can see the ".0" even if the output is a whole number. I think one issue may be with all the spaces in your code.. try this..

| stats sum(SumCost1) as SumCost1, sum(SumHours) as SumHours by Quarter 
| eval HourlyCost = round((SumCost1/SumHours),1)

Re: Line chart does not display the value zero even after setting the code to use one decimal place

marklindo — Tue, 12 Jun 2018 02:56:46 GMT

Hello jluo,

Thanks for the quick response. I tried your suggestion but unfortunately, I still got a whole number on the line chart.

Could this be a version issue (I'm using 7.0.1 on my local machine and implementing the dashboard codes on an instance using 6.4.1) ?

Ben

Re: Line chart does not display the value zero even after setting the code to use one decimal place

jluo_splunk — Tue, 12 Jun 2018 16:09:02 GMT

Could you share a screenshot of the resulting chart and search string?

This wouldn't be a version issue - the round function has been stable historically.

Re: Line chart does not display the value zero even after setting the code to use one decimal place

marklindo — Wed, 13 Jun 2018 07:27:32 GMT

Hello jluo,

Thanks for the response. I attached a link as requested.

https://imgur.com/a/43JXdho

regards,

Ben

Re: Line chart does not display the value zero even after setting the code to use one decimal place

jluo_splunk — Thu, 14 Jun 2018 03:31:48 GMT

Hi Ben,

This is still using your original search string that is plotting out sumCost and sumHours, which are not being rounded. Can you post the result of this string from above?

 | stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter 
 | eval SumCost1 = round(SumCost1, 1)
 | eval SumHours = round(SumHours, 1)
 | eval HourlyCost = round(('Cost1') / ('Hours'),1)

Re: Line chart does not display the value zero even after setting the code to use one decimal place

marklindo — Thu, 14 Jun 2018 04:03:27 GMT

Hello jluo,

I tried your suggestion but i still got the same results.

Please see link: https://imgur.com/a/hnvmk5H

regards,
Ben