Splunk Search

Percentage Eval

justinfranks
Path Finder

Hi All,

There are a lot of percentage questions on this forum but I already know how percentages work but the Eval doesn't seem to work. I will explain.

Here is my search query:

sourcetype="Test" | reverse | delta TimeStamp AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval counter=round(timeDeltaS / 900) | eval to_add=if(counter > 1, (counter - 1), 0) | accum to_add as total_count | eval counter=1 | accum counter as max_count | eval perc=((max_count - total_count) / max_count) | stats max(perc), max(total_count), max(max_count), count(FilesOpen)

Which returns:

max(perc)   max(total_count)    max(max_count)  count(FilesOpen)
1.000000    1                   226             226

As you can see, the perc field is not returning a percentage, it is essentially 100%, but should be around 99% not 100%. However, when I swap total_count with an actual number,

sourcetype="Test" | reverse | delta TimeStamp AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval counter=round(timeDeltaS / 900) | eval to_add=if(counter > 1, (counter - 1), 0) | accum to_add as total_count | eval counter=1 | accum counter as max_count | eval perc=((max_count - 1) / max_count) | stats max(perc), max(total_count), max(max_count), count(FilesOpen)

I get this:

max(perc)   max(total_count)    max(max_count)  count(FilesOpen)
0.995633    1                   229             229

Any ideas?

Tags (3)
0 Karma

HiroshiSatoh
Champion

Isn't total_count 0?

perc=((max_count - total_count) / max_count)
first:1-0/1=1.000000
last:226-1/226=0.995575

perc=((max_count - 1) / max_count)
first:1-1/1=0.000000
last:229-1/229=0.995633

0 Karma

HiroshiSatoh
Champion

I do not think that there is a bug in the calculation of the number of significant digits of SPLUNK.

(I want you to check all the lines here)
sourcetype="Test" | reverse | delta TimeStamp AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval counter=round(timeDeltaS / 900) | eval to_add=if(counter > 1, (counter - 1), 0) | accum to_add as total_count | eval counter=1 | accum counter as max_count | eval perc=((max_count - total_count) / max_count)

0 Karma

justinfranks
Path Finder

I know the math points to total_count being equal to 0 but Splunk reports it as being equal to 1. Hence my confusion.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...