Splunk Search

Is there any documentation on what precision Splunk uses for arithmetic operations?


When I execute the following search

index="does not matter"
| stats count AS value
| eval value=123456.0
| eval x=value/(1024*1024*1024)
| eval y=(value*1.0)/(1024*1024*1024)

I get results which do not quite meet my expectations:

value: 123456.0
x: 0.0001149774
y: 0.00011

Seems like splunk truncates the value. But why? Multiplying by 1.0 should (could, might, ...) transform the value into a floating point number but strangely this results in a less precise result. Is there any documentation on which precision splunk uses for arithmetic operations?

0 Karma
1 Solution


It seems like the documentation explaining how splunk handles precision has been removed; http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Eval is the last version containing the section Significant figures and precision which is pretty important IMHO.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...