https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686858#M234258 <P>Hi, I'm new to Splunk, so I apologize if this question seems naive.</P><P>While experimenting with calculated fields, I found some inconsistent results. Consequently, I removed these fields and tested directly in the search.</P><P>I'm aware that the syntax I'm using here with eval is not the one specified in the documentation, but I'm using it to simulate the calculated field (and it yields the same results). I've seen this use of eval elsewhere but only for very simple things.</P><P>When I run:</P><PRE>stats sum(eval((bytes/(1024*1024)))) as MB</PRE><P>, it works. However, when I run</P><PRE>stats sum(eval(round(bytes/(1024*1024),2))) as MB</PRE><P>I get results, but they are totally inconsistent.</P><P>What could be happening? Where is my mistake? (Note that I'm not looking for the correct solution - I already have it - but I want to understand why this syntax doesn't work.)</P><P>Thanks.</P> Wed, 08 May 2024 09:58:20 GMT FromTheGraves 2024-05-08T09:58:20Z https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686858#M234258 <P>Hi, I'm new to Splunk, so I apologize if this question seems naive.</P><P>While experimenting with calculated fields, I found some inconsistent results. Consequently, I removed these fields and tested directly in the search.</P><P>I'm aware that the syntax I'm using here with eval is not the one specified in the documentation, but I'm using it to simulate the calculated field (and it yields the same results). I've seen this use of eval elsewhere but only for very simple things.</P><P>When I run:</P><PRE>stats sum(eval((bytes/(1024*1024)))) as MB</PRE><P>, it works. However, when I run</P><PRE>stats sum(eval(round(bytes/(1024*1024),2))) as MB</PRE><P>I get results, but they are totally inconsistent.</P><P>What could be happening? Where is my mistake? (Note that I'm not looking for the correct solution - I already have it - but I want to understand why this syntax doesn't work.)</P><P>Thanks.</P> Wed, 08 May 2024 09:58:20 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686858#M234258 FromTheGraves 2024-05-08T09:58:20Z https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686862#M234261 <P>Interesting... Is it a different result every time you run it or at least the same different results for the same input?</P> Wed, 08 May 2024 10:17:55 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686862#M234261 apietsch 2024-05-08T10:17:55Z https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686863#M234262 <P>In what way are they inconsistent? (The totals are most likely different due to the rounding)</P> Wed, 08 May 2024 10:20:16 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686863#M234262 ITWhisperer 2024-05-08T10:20:16Z https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686873#M234267 <P>Rounding errors?</P><P>When you're doing</P><PRE>stats sum(eval(round(bytes/(1024*1024),2))) as MB</PRE><P>You lose some part of the value since you're "cutting off" the part after two decimal digits.</P><P>So the error is expected.</P> Wed, 08 May 2024 11:22:45 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686873#M234267 PickleRick 2024-05-08T11:22:45Z https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686882#M234270 <P class="lia-align-justify">Okay, good point, I must have left my brain somewhere far away...</P><P class="lia-align-justify">Indeed, max(bytes) is 47KB and avg is 2KB, less than 1MB!</P><P class="lia-align-justify">Thank you all for your responsiveness.</P> Wed, 08 May 2024 12:34:36 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-use-of-eval/m-p/686882#M234270 FromTheGraves 2024-05-08T12:34:36Z