Splunk Search

Is there any documentation on what precision Splunk uses for arithmetic operations?

krdo
Communicator

When I execute the following search

index="does not matter"
| stats count AS value
| eval value=123456.0
| eval x=value/(1024*1024*1024)
| eval y=(value*1.0)/(1024*1024*1024)

I get results which do not quite meet my expectations:

value: 123456.0
x: 0.0001149774
y: 0.00011

Seems like splunk truncates the value. But why? Multiplying by 1.0 should (could, might, ...) transform the value into a floating point number but strangely this results in a less precise result. Is there any documentation on which precision splunk uses for arithmetic operations?

0 Karma
1 Solution

krdo
Communicator

It seems like the documentation explaining how splunk handles precision has been removed; http://docs.splunk.com/Documentation/Splunk/4.2.5/SearchReference/Eval is the last version containing the section Significant figures and precision which is pretty important IMHO.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...