Dashboards & Visualizations

Error in 'where' command becuase of ','

Questioner
Path Finder

When I use my code, I can see this error.

" Error in 'where' command : The operator at ',127.542 - 0.001' is invalid.

The problem code is this.

| where time >= $max_value$ - 0.001

 When I print "max_value"  at title, I can see that value is "315,127.542"

 

I think the reason this problem occurred is  ',' at the max_value. 

How could I remove ',' at the max_value?

And If it was not the problem, How could I solve this?

Labels (1)
Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

You can use an <eval> statement for your drilldown instead of <set>

<eval token="max_value">replace($click.value$, ",", "")</eval>

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Technically you could do the following to fix the symptoms

| where time >= tonmumber(replace($max_value$, ",", "")) - 0.001

but you are better off finding the source of the token, as @PickleRick says, and make sure it contains something suitable to perform calculations with if that's how you intend to use it.

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. The question is where are you getting this token from. Because apparently it's a formatted number which indeed might cause the error.

0 Karma

Questioner
Path Finder

OH..! I get this token at <single> block.

The code for this <signle> block looks like this.

<single>
<title>Max time</title>
<search>
<query>index=idx_prd_analysis sourcetype="type:prd_analysis:delay_time" corp="delay"
| where (plane_type==1) OR (plane_type==2)
| eval total_time = round(takeOff_time - boarding_time, 3)
| stats MAX(total_time)</query>
<earliest>$_time.earliest$</earliest>
<latest>$_time.latest$</latest>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="height">154</option>
<option name="numberPrecision">0.000</option>
<option name="rangeValues">[500]</option>
<option name="refresh.display">progressbar</option>
<option name="unitPosition">before</option>
<drilldown>
<set token="max_value">$click.value$</set>
</drilldown>
</single> 

 

Are there any solution to send max_value as normal format not origin? (Not 123,456 -> Wnat 123456)

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can use an <eval> statement for your drilldown instead of <set>

<eval token="max_value">replace($click.value$, ",", "")</eval>

 

0 Karma

Questioner
Path Finder

It work!!!
Thank you for your help 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...