Splunk Search

Why is timechart returning null results if eval returns a value less than 1?

pkeller
Contributor

I'm finding that timechart is returning null results if my number is less than 1.

earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(value) as myValue by host

If the overall average of value is less than one ... ie: .2 or .7 etc ... I get a null result in myValue

This works fine for numbers 1 or greater.

I've tried using round, exact, and eval(avg(value)*10) ... I still get null results.

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

 earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(tonumber(value)) as myValue by host

View solution in original post

0 Karma

pkeller
Contributor

never mind ... If I change the provided value to 0.2, 0.7 etc ... this works.

0 Karma

woodcock
Esteemed Legend

Try this:

 earliest=-3d latest=-1d sourcetype=foo | timechart span=1h avg(tonumber(value)) as myValue by host
0 Karma

pkeller
Contributor

Thank you ... that didn't quite work, but you pointed me in the right direction ...

earliest=-3d latest=-1d sourcetype=foo | eval number=tonumber(value) | timechart span=1h avg(number) as myValue by host

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...