Splunk Search

Eval math expression over null values

splunk_zen
Builder

How can I get a result out of an eval expression (without falsely decreasing the result computing its components as 0) if I there is a day and a half which I have no data?

My goal is to timechart a score with that gap in it, not represent the lack of data as 0.

If I replace the

TotalEvents,0 

by

TotalEvents,"" 

in the eval expressions,
The CpuScore eval just breaks and is always null acroos All Time, even on the other days which I have data.

| eval ACpuApdex=if(Platform="A",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
| eval BCpuApdex=if(Platform="B",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
...
| eval BCpuApdex=if(Platform="K",(TotalOptimumCpu + TotalAcceptableCpu/2) / TotalEvents,0)
| eval CpuScore=round(
100*(
0.16*(0.7*ACpuApdex + B*FeCpuApdex)
+ 0.16*CCpuApdex 
...
)
)
| timechart span=1d sum(CpuScore) as CpuScore
Tags (2)
0 Karma

lpolo
Motivator

Have tried:
| timechart cont=false span=1d sum(CpuScore) as CpuScore

0 Karma

splunk_zen
Builder

Thanks Ipolo.
The issue is that the result of

| eval CpuScore=...

is either 0 in that given day(if I leave the TotalEvents,0
in the previous eval expressions)

or null across All Time (if I replace it by TotalEvents,"")

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...