- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I use my code, I can see this error.
" Error in 'where' command : The operator at ',127.542 - 0.001' is invalid.
The problem code is this.
| where time >= $max_value$ - 0.001
When I print "max_value" at title, I can see that value is "315,127.542"
I think the reason this problem occurred is ',' at the max_value.
How could I remove ',' at the max_value?
And If it was not the problem, How could I solve this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
You can use an <eval> statement for your drilldown instead of <set>
<eval token="max_value">replace($click.value$, ",", "")</eval>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Technically you could do the following to fix the symptoms
| where time >= tonmumber(replace($max_value$, ",", "")) - 0.001
but you are better off finding the source of the token, as @PickleRick says, and make sure it contains something suitable to perform calculations with if that's how you intend to use it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
OK. The question is where are you getting this token from. Because apparently it's a formatted number which indeed might cause the error.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OH..! I get this token at <single> block.
The code for this <signle> block looks like this.
<single>
<title>Max time</title>
<search>
<query>index=idx_prd_analysis sourcetype="type:prd_analysis:delay_time" corp="delay"
| where (plane_type==1) OR (plane_type==2)
| eval total_time = round(takeOff_time - boarding_time, 3)
| stats MAX(total_time)</query>
<earliest>$_time.earliest$</earliest>
<latest>$_time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="height">154</option>
<option name="numberPrecision">0.000</option>
<option name="rangeValues">[500]</option>
<option name="refresh.display">progressbar</option>
<option name="unitPosition">before</option>
<drilldown>
<set token="max_value">$click.value$</set>
</drilldown>
</single>
Are there any solution to send max_value as normal format not origin? (Not 123,456 -> Wnat 123456)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
You can use an <eval> statement for your drilldown instead of <set>
<eval token="max_value">replace($click.value$, ",", "")</eval>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It work!!!
Thank you for your help
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)