Splunk Search

Number comparison seems not to be working

tommasoscarpa1
Path Finder

Hi,

 

This thing is getting me crazy.

I am running Splunk 9.2.1 and I have the following table:

amountcomparefrac_typefractioninteger
0.41FNumber0.410
4.18FNumber0.184
0.26FNumber0.260
0.34FNumber0.340
10.60FNumber0.6010
0.11FNumber0.110
2.00FNumber0.002
3.49FNumber0.493
10.58FNumber0.5810
2.00FNumber0.002
1.02FNumber0.021
15.43FNumber0.4315
1.17FNumber0.171

 

And these are the evals I used to calculate the fields:

| eval integer = floor(amount)
| eval fraction = amount - floor(amount)
| eval frac_type = typeof(fraction)
| eval compare = if(fraction = 0.6, "T", "F")

 

Now, I really can't understand how the "compare" field is always false.... I was expecting it to output TRUE on row 5 with amount = 10.60, which means fraction = 0.6, but it does not.

What am I doing wrong here? Why "compare" evaluates to FALSE on row 5?

I tried to change 0.6 with 0.60 (you never know), but no luck.

 

If you want you can try this run anywhere search, which gives me the same result:

 

| makeresults
| eval amount = 10.6
| eval integer = floor(amount)
| eval fraction = amount - floor(amount)
| eval frac_type = typeof(fraction)
| eval compare = if(fraction = 0.6, "T", "F")

 

Can you help me?

 

 

Thank you in advance,

Tommaso

Labels (1)
0 Karma
1 Solution

tommasoscarpa1
Path Finder

Thank you @PickleRick for your answer.

Eventually I worked around the problem like this:

| makeresults
| eval amount = 10.6
| eval integer = floor(amount)
| eval fraction = round(amount - floor(amount), 2)
| eval compare = if(fraction = 0.6, "T", "F")



I simply rounded the floating point number to some decimal places.

I tested also your example and this solves this problem (that is not actually a problem as you suggested).

 

Thank you!

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Because... it's Splunk math (I suppose it has something to do with float handling underneath).

See this run-anywhere example

| makeresults count=10
| streamstats count
| map search="|makeresults count=$count$| streamstats count as count2 | eval count=$count$"
| eval count=count/10, count2=count2/10
| eval diff=count-count2
| table count count2 diff

 

tommasoscarpa1
Path Finder

I see.

So for Splunk 0.3 - 0.1 equals 0.19999999999 instead of 0.2.

Do you know how can I work around this in my example?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I suppose it's not "for Splunk" but rather it's simply a floating point arithmetics which is not as straightforward as we are used to.

You could simply manipulate numbers being 1 or 2 orders of magnitude bigger than your "real" values so that you operate on integers.

This is a common problem with floating-point arithmetics - numbers are not what they seem (or seems they should be).

tommasoscarpa1
Path Finder

Thank you @PickleRick for your answer.

Eventually I worked around the problem like this:

| makeresults
| eval amount = 10.6
| eval integer = floor(amount)
| eval fraction = round(amount - floor(amount), 2)
| eval compare = if(fraction = 0.6, "T", "F")



I simply rounded the floating point number to some decimal places.

I tested also your example and this solves this problem (that is not actually a problem as you suggested).

 

Thank you!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...