Splunk Search

Line chart does not display the value zero even after setting the code to use one decimal place

marklindo
New Member

Hello,

Seeking for any assistance on the issue I am encountering.

Issue: Line chart does not display the value zero even after setting the code to use one decimal place. E.g. a value with 6.7 will display the ".7" after the number but a value with 6.0 only displays 6 in the line chart without the ".0"

Here's a screenshot of the line chart:
![alt text][1]

Here's the code I have created to generate the line chart:
| stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter
| eval HourlyCost = round(('Cost1') / ('Hours'),1)

I'm not sure how this can be addressed so any help would be very much appreciated.

Thank you for assisting.

Ben

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

Hi Marklindo,

It looks like your search is plotting SumCost1 and SumHours by quarter, but those two fields are not being manipulated to show the first decimal place - you are only manipulating HourlyCost. If you'd like the two lines on the chart (SumCost1 and SumHours) to include the first decimal place, try this..

| stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter 
| eval SumCost1 = round(SumCost1, 1)
| eval SumHours = round(SumHours, 1)
| eval HourlyCost = round(('Cost1') / ('Hours'),1)
0 Karma

marklindo
New Member

Hello Jluo,

Thanks for the response. I apologize but I made a mistake on the code I posted. Here's the correct version of the code:

| stats sum(SumCost1) as SumCost1, sum(SumHours ) as SumHours by Quarter
| eval HourlyCost = round ( ( 'SumCost1' / 'SumHours ' ) ,1 )

You were correct in your assessment that I am plotting SumCost1 and SumHours by Quarter. I did try your suggestion but there were no changes on the output.

Is it safe to conclude that Splunk does not plot the ".0" if the output is a whole number. I did test this theory by rounding to 2 decimal places and got a value of "1.09" (apologies I am having difficulty attaching the screenshot on the reply button) .

Ben

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

Ben,

I tested on my own env and can confirm that I can see the ".0" even if the output is a whole number. I think one issue may be with all the spaces in your code.. try this..

| stats sum(SumCost1) as SumCost1, sum(SumHours) as SumHours by Quarter 
| eval HourlyCost = round((SumCost1/SumHours),1)
0 Karma

marklindo
New Member

Hello jluo,

Thanks for the quick response. I tried your suggestion but unfortunately, I still got a whole number on the line chart.

Could this be a version issue (I'm using 7.0.1 on my local machine and implementing the dashboard codes on an instance using 6.4.1) ?

Ben

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

Could you share a screenshot of the resulting chart and search string?

This wouldn't be a version issue - the round function has been stable historically.

0 Karma

marklindo
New Member

Hello jluo,

Thanks for the response. I attached a link as requested.

https://imgur.com/a/43JXdho

regards,

Ben

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

Hi Ben,

This is still using your original search string that is plotting out sumCost and sumHours, which are not being rounded. Can you post the result of this string from above?

 | stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter 
 | eval SumCost1 = round(SumCost1, 1)
 | eval SumHours = round(SumHours, 1)
 | eval HourlyCost = round(('Cost1') / ('Hours'),1)
0 Karma

marklindo
New Member

Hello jluo,

I tried your suggestion but i still got the same results.

Please see link: https://imgur.com/a/hnvmk5H

regards,
Ben

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...