Splunk Search

## Eval rounding error too big

Path Finder

Hi, I'm getting a big rounding error when evaluating floating expressions.
Here is the search that is evaluating the following table:

``````| stats sum(AmountActualCcy) as TransactionSum by RetailerId  | eval FINAL = (0.1 * TransactionSum)

RetailerId  TransactionSum  FINAL
1   33215   3091170.69  300000
2   519973  3269504.11  300000
3   54655   2952796.05  300000
4   59518   2965221.65  300000
5   67889   2840332.81  300000
6   68117   3113385.64  300000
7   81275   3099565.43  300000
8   849454  3140473.26  300000
9   921976  3076440.38  300000
``````

Is there maybe some function to force float evaluation of expression?

Tags (2)
1 Solution
Path Finder

Ok, found exact() function that solves my problem.

This function evaluates an expression X using double precision floating point arithmetic.

solution looks like this:

``````eval FINAL = exact(0.1 * TransactionSum)
``````

Another question if I try to evaluate two fields like following I get no results, like there was no evaluation, both fields are recognized by splunk as numerical and are present in all events:

`````` ... | lookup RetailerNames.csv RetailerId as RetailerId OUTPUT Fee, FirmName | search FirmName="Apple" | stats sum(AmountActualCcy) as TransactionSum by RetailerId, FirmName | eval FINAL = exact( TransactionSum * Fee)
``````

Any ideas why this wouldn't work?

Path Finder

Ok, found exact() function that solves my problem.

This function evaluates an expression X using double precision floating point arithmetic.

solution looks like this:

``````eval FINAL = exact(0.1 * TransactionSum)
``````

Another question if I try to evaluate two fields like following I get no results, like there was no evaluation, both fields are recognized by splunk as numerical and are present in all events:

`````` ... | lookup RetailerNames.csv RetailerId as RetailerId OUTPUT Fee, FirmName | search FirmName="Apple" | stats sum(AmountActualCcy) as TransactionSum by RetailerId, FirmName | eval FINAL = exact( TransactionSum * Fee)
``````

Any ideas why this wouldn't work?

*NEW* Splunk Love Promo!