Line chart does not display the value zero even after setting the code to use one decimal place

[marklindo]

Hello,

Seeking for any assistance on the issue I am encountering.

Issue: Line chart does not display the value zero even after setting the code to use one decimal place. E.g. a value with 6.7 will display the ".7" after the number but a value with 6.0 only displays 6 in the line chart without the ".0"

Here's a screenshot of the line chart:
![alt text][1]

Here's the code I have created to generate the line chart:
| stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter
| eval HourlyCost = round(('Cost1') / ('Hours'),1)

I'm not sure how this can be addressed so any help would be very much appreciated.

Thank you for assisting.

Ben

[jluo_splunk]

Hi Marklindo,

It looks like your search is plotting SumCost1 and SumHours by quarter, but those two fields are not being manipulated to show the first decimal place - you are only manipulating HourlyCost. If you'd like the two lines on the chart (SumCost1 and SumHours) to include the first decimal place, try this..

| stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter 
| eval SumCost1 = round(SumCost1, 1)
| eval SumHours = round(SumHours, 1)
| eval HourlyCost = round(('Cost1') / ('Hours'),1)

[marklindo]

Hello Jluo,

Thanks for the response. I apologize but I made a mistake on the code I posted. Here's the correct version of the code:

| stats sum(SumCost1) as SumCost1, sum(SumHours ) as SumHours by Quarter
| eval HourlyCost = round ( ( 'SumCost1' / 'SumHours ' ) ,1 )

You were correct in your assessment that I am plotting SumCost1 and SumHours by Quarter. I did try your suggestion but there were no changes on the output.

Is it safe to conclude that Splunk does not plot the ".0" if the output is a whole number. I did test this theory by rounding to 2 decimal places and got a value of "1.09" (apologies I am having difficulty attaching the screenshot on the reply button) .

Ben

[jluo_splunk]

Ben,

I tested on my own env and can confirm that I can see the ".0" even if the output is a whole number. I think one issue may be with all the spaces in your code.. try this..

| stats sum(SumCost1) as SumCost1, sum(SumHours) as SumHours by Quarter 
| eval HourlyCost = round((SumCost1/SumHours),1)

[marklindo]

Hello jluo,

Thanks for the quick response. I tried your suggestion but unfortunately, I still got a whole number on the line chart.

Could this be a version issue (I'm using 7.0.1 on my local machine and implementing the dashboard codes on an instance using 6.4.1) ?

Ben

[jluo_splunk]

Could you share a screenshot of the resulting chart and search string?

This wouldn't be a version issue - the round function has been stable historically.

[marklindo]

Hello jluo,

Thanks for the response. I attached a link as requested.

https://imgur.com/a/43JXdho

regards,

Ben

[jluo_splunk]

Hi Ben,

This is still using your original search string that is plotting out sumCost and sumHours, which are not being rounded. Can you post the result of this string from above?

 | stats sum(Cost1) as SumCost1, sum(Hours) as SumHours by Quarter 
 | eval SumCost1 = round(SumCost1, 1)
 | eval SumHours = round(SumHours, 1)
 | eval HourlyCost = round(('Cost1') / ('Hours'),1)

[marklindo]

Hello jluo,

I tried your suggestion but i still got the same results.

Please see link: https://imgur.com/a/hnvmk5H

regards,
Ben