Splunk Search

When multiplying 3 fields to get a new field, why does Splunk round the result when the fields are decimals?

nsanchezfernand
Path Finder

Hi.

I have one issue with my search. I need to multiply three fields to get another new field. When I do the multiply, in some cases it works right, but with some values it rounds the result...

For example:

I need to multiply next fields: cw \* tcw \* aw and put the result in the field called wt. There's no problem when these fields are integers, in this case Splunk multiplies them well, but when these fields are decimal, Splunk rounds the result, and I don't know why.

alt text

The part of the search that does this is:

| convert num(cw) as cw, num(tcw) as tcw, num(aw) as aw
| eval wt=cw \* tcw \* aw
| stats values(wt)  values(cw) values(tcw) values(aw) by Month, cou, techclu, app, appid, act, ow, aid, acty, afm ,camp

Anyone knows what can be happening?? I've tried all, and it returns me the same result again and again.

Thanks!!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk normally performs integer arithmetic unless you specify otherwise. Try the exact operator.

| convert num(cw) as cw, num(tcw) as tcw, num(aw) as aw
| eval wt=exact(cw * tcw * aw)
| stats values(wt)  values(cw) values(tcw) values(aw) by Month, cou, techclu, app, appid, act, ow, aid, acty, afm ,camp
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Splunk normally performs integer arithmetic unless you specify otherwise. Try the exact operator.

| convert num(cw) as cw, num(tcw) as tcw, num(aw) as aw
| eval wt=exact(cw * tcw * aw)
| stats values(wt)  values(cw) values(tcw) values(aw) by Month, cou, techclu, app, appid, act, ow, aid, acty, afm ,camp
---
If this reply helps you, Karma would be appreciated.

nsanchezfernand
Path Finder

Thanks so much!!

It's working perfectly. Now, it's returning the exact hoped result.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...