Splunk Search

Why is timechart returning null results if eval returns a value less than 1?

pkeller
Contributor

I'm finding that timechart is returning null results if my number is less than 1.

earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(value) as myValue by host

If the overall average of value is less than one ... ie: .2 or .7 etc ... I get a null result in myValue

This works fine for numbers 1 or greater.

I've tried using round, exact, and eval(avg(value)*10) ... I still get null results.

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

 earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(tonumber(value)) as myValue by host

View solution in original post

0 Karma

pkeller
Contributor

never mind ... If I change the provided value to 0.2, 0.7 etc ... this works.

0 Karma

woodcock
Esteemed Legend

Try this:

 earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(tonumber(value)) as myValue by host
0 Karma

pkeller
Contributor

Thank you ... that didn't quite work, but you pointed me in the right direction ...

earliest=-3d latest=-1d sourcetype=foo | eval number=tonumber(value) | timechart span=1h avg(number) as myValue by host

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...