Splunk Search
Highlighted

Weird / Faulty (?) Behaviour when comparing numbers

Explorer

Hello,
I am currently facing a weird behaviour when comparing two numeric fields in splunk.
alt text

The attached screenshot shows the situation, where I want to compare the time difference to some previous and some subsequent event. The fields for the (correctly calculated) difference are prevDif and postDif. I compare them to gather a decision of which event should be taken (selectedPosition). I multiplied the prevDif and postDif by 2 after I encountered the error, to verify the fields are treated as numbers (and they are, postDif was 42 without the multiplication in most of the cases). So as 0 is clearly < 84 the selectedPosition should be "prev" but somehow the comparison fails and "post" is selected.
Can someone explain this behaviour or is this just a bug?
I would greatly appreciate any hints to why this does not work correctly!

0 Karma
Highlighted

Re: Weird / Faulty (?) Behaviour when comparing numbers

SplunkTrust
SplunkTrust

Typo. Change prevDiv to prevDif in line 58.

note - you can use *1.0 rather than *2 and the result would be numeric and unchanged.

View solution in original post

0 Karma
Highlighted

Re: Weird / Faulty (?) Behaviour when comparing numbers

Explorer

Thanks a lot, I was probably staring for too long at this problem to notice the obvious 😄

Highlighted

Re: Weird / Faulty (?) Behaviour when comparing numbers

SplunkTrust
SplunkTrust

@sh4kesbeer - It's always easier to catch those in other people's code. If we sat across the aisle from each other, you'd do it for me just as well.

0 Karma