https://community.splunk.com/t5/Splunk-Search/eval-inconsistent-math-result/m-p/91888#M23717 <P>How is it possible that an eval expression which its components total weight is 100, breach that expected value?<BR /><BR /> For a given period, I'm getting a result of 101,<BR /><BR /> while expression components weights are (it totals to 100)<BR /><BR /> 100*(0.08 + 0.03 + 0.12 + 0.16 + 0.06 + 0.18 + 0.06 + 0.06 + 0.25)<BR /><BR /> and there is not even one component value which exceeds 1.</P> <PRE><CODE>| eval TimeoutScore=100*( 0.08*(bw1sdpSdfPccCsApdex) + 0.03*bw1sdpSdfPccMnCsApdex + 0.12*bw1sdpSdfPccPsApdex + 0.16*(0.5*bw1sdpSdfPpsCsApdex +0.5*bw2sdpSdfPpsCsApdex) + 0.06*(0.5*bw1sdpSdfPpsMnCsApdex +0.5*bw2sdpSdfPpsMnCsApdex) + 0.18*(0.5*bw1sdpSdfPpsPsApdex + 0.5*bw2sdpSdfPpsPsApdex) + 0.06*(0.5*bw1sdpSdfPpsVisaCsApdex + 0.5*bw2sdpSdfPpsVisaCsApdex) + 0.06*bw1careSdfMnApdex + 0.25*(0.5*bw1sdpSdfSlrApdex + 0.5*bw2sdpSdfSlrApdex)) | stats sum(TimeoutScore) as TimeoutScore sum(bw1sdpSdfPccCsApdex) sum(bw1sdpSdfPccMnCsApdex) sum(bw1sdpSdfPccPsApdex) sum(bw1sdpSdfPpsCsApdex) sum(bw2sdpSdfPpsCsApdex) sum(bw1sdpSdfPpsMnCsApdex) sum(bw2sdpSdfPpsMnCsApdex) sum(bw1sdpSdfPpsPsApdex) sum(bw2sdpSdfPpsPsApdex) sum(bw1sdpSdfPpsVisaCsApdex) sum(bw2sdpSdfPpsVisaCsApdex) sum(bw1careSdfMnApdex) sum(bw1sdpSdfSlrApdex) sum(bw2sdpSdfSlrApdex) TimeoutScore sum(bw1sdpSdfPccCsApdex) sum(bw1sdpSdfPccMnCsApdex) sum(bw1sdpSdfPccPsApdex) sum(bw1sdpSdfPpsCsApdex) sum(bw2sdpSdfPpsCsApdex) sum(bw1sdpSdfPpsMnCsApdex) sum(bw2sdpSdfPpsMnCsApdex) sum(bw1sdpSdfPpsPsApdex) sum(bw2sdpSdfPpsPsApdex) sum(bw1sdpSdfPpsVisaCsApdex) sum(bw2sdpSdfPpsVisaCsApdex) sum(bw1careSdfMnApdex) sum(bw1sdpSdfSlrApdex) sum(bw2sdpSdfSlrApdex) 101 1 0.854839 0.972727 1 1 1 1 0.975410 1 1 1 0.983871 1 1 </CODE></PRE> <P><STRONG>EDIT:</STRONG><BR /> Thanks to kristian.kolb suggestion, this issue was solved replacing </P> <PRE><CODE>| eval TimeoutScore=... </CODE></PRE> <P>by</P> <PRE><CODE>| eval TimeoutScore=exact(...) </CODE></PRE> Fri, 12 Apr 2013 09:59:33 GMT splunk_zen 2013-04-12T09:59:33Z https://community.splunk.com/t5/Splunk-Search/eval-inconsistent-math-result/m-p/91888#M23717 <P>How is it possible that an eval expression which its components total weight is 100, breach that expected value?<BR /><BR /> For a given period, I'm getting a result of 101,<BR /><BR /> while expression components weights are (it totals to 100)<BR /><BR /> 100*(0.08 + 0.03 + 0.12 + 0.16 + 0.06 + 0.18 + 0.06 + 0.06 + 0.25)<BR /><BR /> and there is not even one component value which exceeds 1.</P> <PRE><CODE>| eval TimeoutScore=100*( 0.08*(bw1sdpSdfPccCsApdex) + 0.03*bw1sdpSdfPccMnCsApdex + 0.12*bw1sdpSdfPccPsApdex + 0.16*(0.5*bw1sdpSdfPpsCsApdex +0.5*bw2sdpSdfPpsCsApdex) + 0.06*(0.5*bw1sdpSdfPpsMnCsApdex +0.5*bw2sdpSdfPpsMnCsApdex) + 0.18*(0.5*bw1sdpSdfPpsPsApdex + 0.5*bw2sdpSdfPpsPsApdex) + 0.06*(0.5*bw1sdpSdfPpsVisaCsApdex + 0.5*bw2sdpSdfPpsVisaCsApdex) + 0.06*bw1careSdfMnApdex + 0.25*(0.5*bw1sdpSdfSlrApdex + 0.5*bw2sdpSdfSlrApdex)) | stats sum(TimeoutScore) as TimeoutScore sum(bw1sdpSdfPccCsApdex) sum(bw1sdpSdfPccMnCsApdex) sum(bw1sdpSdfPccPsApdex) sum(bw1sdpSdfPpsCsApdex) sum(bw2sdpSdfPpsCsApdex) sum(bw1sdpSdfPpsMnCsApdex) sum(bw2sdpSdfPpsMnCsApdex) sum(bw1sdpSdfPpsPsApdex) sum(bw2sdpSdfPpsPsApdex) sum(bw1sdpSdfPpsVisaCsApdex) sum(bw2sdpSdfPpsVisaCsApdex) sum(bw1careSdfMnApdex) sum(bw1sdpSdfSlrApdex) sum(bw2sdpSdfSlrApdex) TimeoutScore sum(bw1sdpSdfPccCsApdex) sum(bw1sdpSdfPccMnCsApdex) sum(bw1sdpSdfPccPsApdex) sum(bw1sdpSdfPpsCsApdex) sum(bw2sdpSdfPpsCsApdex) sum(bw1sdpSdfPpsMnCsApdex) sum(bw2sdpSdfPpsMnCsApdex) sum(bw1sdpSdfPpsPsApdex) sum(bw2sdpSdfPpsPsApdex) sum(bw1sdpSdfPpsVisaCsApdex) sum(bw2sdpSdfPpsVisaCsApdex) sum(bw1careSdfMnApdex) sum(bw1sdpSdfSlrApdex) sum(bw2sdpSdfSlrApdex) 101 1 0.854839 0.972727 1 1 1 1 0.975410 1 1 1 0.983871 1 1 </CODE></PRE> <P><STRONG>EDIT:</STRONG><BR /> Thanks to kristian.kolb suggestion, this issue was solved replacing </P> <PRE><CODE>| eval TimeoutScore=... </CODE></PRE> <P>by</P> <PRE><CODE>| eval TimeoutScore=exact(...) </CODE></PRE> Fri, 12 Apr 2013 09:59:33 GMT https://community.splunk.com/t5/Splunk-Search/eval-inconsistent-math-result/m-p/91888#M23717 splunk_zen 2013-04-12T09:59:33Z https://community.splunk.com/t5/Splunk-Search/eval-inconsistent-math-result/m-p/91889#M23718 <P>Rounding errors? perhaps the <CODE>exact()</CODE> function for <CODE>eval</CODE> might help?</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> Fri, 12 Apr 2013 10:22:35 GMT https://community.splunk.com/t5/Splunk-Search/eval-inconsistent-math-result/m-p/91889#M23718 kristian_kolb 2013-04-12T10:22:35Z https://community.splunk.com/t5/Splunk-Search/eval-inconsistent-math-result/m-p/91890#M23719 <P>Dammit... Forgot that could be the culprit.<BR /> If you promote the comment to an answer I will gladly accept it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 12 Apr 2013 10:25:03 GMT https://community.splunk.com/t5/Splunk-Search/eval-inconsistent-math-result/m-p/91890#M23719 splunk_zen 2013-04-12T10:25:03Z