Splunk Search

Comma separated number in sum function going negative

mjones414
Contributor

in the following situation:
... | stats sum(SumofCoreSecs) as total | eval Total = tostring(total, "commas") | table Total

This works fine up until a certain length of a number, but I recently ran across a sum value that went negative:

-9,302,873,272,376

I know that there are no negative numbers in the raw data. Is this a condition of the sum function?

Tags (2)
0 Karma
1 Solution

mjones414
Contributor

I actually figured out that my problem was the length of the _raw field itself. Occasionally the data I'm pulling in has valid event-per-line events that exceed 10,000 characters, so I had to turn truncate off in the sourcetypes and it stopped chopping off my data in random places. Splunk has a default limit here of 10,000 characters. Unfortunately I lost some data in the process of learning this that can't be regenerated but I'll catch it for future iterations.

Thanks for the help!

View solution in original post

mjones414
Contributor

I actually figured out that my problem was the length of the _raw field itself. Occasionally the data I'm pulling in has valid event-per-line events that exceed 10,000 characters, so I had to turn truncate off in the sourcetypes and it stopped chopping off my data in random places. Splunk has a default limit here of 10,000 characters. Unfortunately I lost some data in the process of learning this that can't be regenerated but I'll catch it for future iterations.

Thanks for the help!

strive
Influencer

Assuming that your SumofCoreSecs doesn't contain commas, i tested the sum function with much bigger values and it worked just fine.

In case if your SumofCoreSecs contain commas then use convert function to remove commas. See this link http://answers.splunk.com/answers/36792/how-to-sum-numbers-with-commas

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Does the field SumofCoreSecs have commas?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...