Dashboards & Visualizations

Error in 'where' command becuase of ','

Questioner
Path Finder

When I use my code, I can see this error.

" Error in 'where' command : The operator at ',127.542 - 0.001' is invalid.

The problem code is this.

| where time >= $max_value$ - 0.001

 When I print "max_value"  at title, I can see that value is "315,127.542"

 

I think the reason this problem occurred is  ',' at the max_value. 

How could I remove ',' at the max_value?

And If it was not the problem, How could I solve this?

Labels (1)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can use an <eval> statement for your drilldown instead of <set>

<eval token="max_value">replace($click.value$, ",", "")</eval>

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Technically you could do the following to fix the symptoms

| where time >= tonmumber(replace($max_value$, ",", "")) - 0.001

but you are better off finding the source of the token, as @PickleRick says, and make sure it contains something suitable to perform calculations with if that's how you intend to use it.

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. The question is where are you getting this token from. Because apparently it's a formatted number which indeed might cause the error.

0 Karma

Questioner
Path Finder

OH..! I get this token at <single> block.

The code for this <signle> block looks like this.

<single>
<title>Max time</title>
<search>
<query>index=idx_prd_analysis sourcetype="type:prd_analysis:delay_time" corp="delay"
| where (plane_type==1) OR (plane_type==2)
| eval total_time = round(takeOff_time - boarding_time, 3)
| stats MAX(total_time)</query>
<earliest>$_time.earliest$</earliest>
<latest>$_time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="height">154</option>
<option name="numberPrecision">0.000</option>
<option name="rangeValues">[500]</option>
<option name="refresh.display">progressbar</option>
<option name="unitPosition">before</option>
<drilldown>
<set token="max_value">$click.value$</set>
</drilldown>
</single> 

 

Are there any solution to send max_value as normal format not origin? (Not 123,456 -> Wnat 123456)

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use an <eval> statement for your drilldown instead of <set>

<eval token="max_value">replace($click.value$, ",", "")</eval>

 

0 Karma

Questioner
Path Finder

It work!!!
Thank you for your help 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...