Splunk Search

Why are comparisons not working with percentages as expected?

Explorer

Im working with some thresholds and I'm using |eval score = if(percentage>Target, 1, percentage<=Target, 0)

Looks simple and I thought it would be. My percentage fields are just numbers and my Target fields are percentages (e.g. 99.5%)

But, when my number field becomes 100.00, the score becomes 0 no matter what Target values there are.

If I do | eval isHundred = if(percentage==100, 1, 0) I get results of 1.

And, if I take 0.01 away from 100.00, the values are return as expected for the lower value.

What's going on here?

I'm working on 7.0.0.

Thanks

0 Karma

Contributor

Please have a look below

| makeresults
| eval percentage="100.00" "Your pecentae value"
| eval Target = "9%" " your target value"
| eval Target = substr(Target,0,len(Target)-1) " we are using substr to remove % sign from events , as values needed to be numberic only for next statement "
| eval score = case(percentage>Target, 1, percentage<=Target, 0) " You have used if and its supposed to be case statement"

0 Karma