Im working with some thresholds and I'm using |eval score = if(percentage>Target, 1, percentage<=Target, 0)
Looks simple and I thought it would be. My percentage fields are just numbers and my Target fields are percentages (e.g. 99.5%)
But, when my number field becomes 100.00, the score becomes 0 no matter what Target values there are.
If I do | eval isHundred = if(percentage==100, 1, 0)
I get results of 1.
And, if I take 0.01 away from 100.00, the values are return as expected for the lower value.
What's going on here?
I'm working on 7.0.0.
Thanks
Please have a look below
| makeresults
| eval percentage="100.00" "Your pecentae value"
| eval Target = "9%" " your target value"
| eval Target = substr(Target,0,len(Target)-1) " we are using substr to remove % sign from events , as values needed to be numberic only for next statement "
| eval score = case(percentage>Target, 1, percentage<=Target, 0) " You have used if and its supposed to be case statement"