topic Re: Why is timechart returning null results if eval returns a value less than 1? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227492#M67186 <P>Thank you ... that didn't quite work, but you pointed me in the right direction ...</P> <P>earliest=-3d latest=-1d sourcetype=foo | eval number=tonumber(value) | timechart span=1h avg(number) as myValue by host</P> Mon, 16 Nov 2015 15:31:25 GMT pkeller 2015-11-16T15:31:25Z Why is timechart returning null results if eval returns a value less than 1? https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227489#M67183 <P>I'm finding that timechart is returning null results if my number is less than 1.</P> <PRE><CODE>earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(value) as myValue by host </CODE></PRE> <P>If the overall average of <STRONG>value</STRONG> is less than one ... ie: .2 or .7 etc ... I get a null result in <STRONG>myValue</STRONG></P> <P>This works fine for numbers 1 or greater.</P> <P>I've tried using <CODE>round</CODE>, <CODE>exact</CODE>, and <CODE>eval(avg(value)*10)</CODE> ... I still get null results. </P> Fri, 13 Nov 2015 20:36:07 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227489#M67183 pkeller 2015-11-13T20:36:07Z Re: Why is timechart returning null results if eval returns a value less than 1? https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227490#M67184 <P>Try this:</P> <PRE><CODE> earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(tonumber(value)) as myValue by host </CODE></PRE> Fri, 13 Nov 2015 20:49:26 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227490#M67184 woodcock 2015-11-13T20:49:26Z Re: Why is timechart returning null results if eval returns a value less than 1? https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227491#M67185 <P>never mind ... If I change the provided value to 0.2, 0.7 etc ... this works.</P> Fri, 13 Nov 2015 20:50:48 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227491#M67185 pkeller 2015-11-13T20:50:48Z Re: Why is timechart returning null results if eval returns a value less than 1? https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227492#M67186 <P>Thank you ... that didn't quite work, but you pointed me in the right direction ...</P> <P>earliest=-3d latest=-1d sourcetype=foo | eval number=tonumber(value) | timechart span=1h avg(number) as myValue by host</P> Mon, 16 Nov 2015 15:31:25 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-timechart-returning-null-results-if-eval-returns-a-value/m-p/227492#M67186 pkeller 2015-11-16T15:31:25Z