I am currently facing a weird behaviour when comparing two numeric fields in splunk.
The attached screenshot shows the situation, where I want to compare the time difference to some previous and some subsequent event. The fields for the (correctly calculated) difference are prevDif and postDif. I compare them to gather a decision of which event should be taken (selectedPosition). I multiplied the prevDif and postDif by 2 after I encountered the error, to verify the fields are treated as numbers (and they are, postDif was 42 without the multiplication in most of the cases). So as 0 is clearly < 84 the selectedPosition should be "prev" but somehow the comparison fails and "post" is selected.
Can someone explain this behaviour or is this just a bug?
I would greatly appreciate any hints to why this does not work correctly!
prevDif in line 58.
note - you can use
*1.0 rather than
*2 and the result would be numeric and unchanged.
@sh4kesbeer - It's always easier to catch those in other people's code. If we sat across the aisle from each other, you'd do it for me just as well.