incorrect use of eval?

[FromTheGraves]

Hi, I'm new to Splunk, so I apologize if this question seems naive.

While experimenting with calculated fields, I found some inconsistent results. Consequently, I removed these fields and tested directly in the search.

I'm aware that the syntax I'm using here with eval is not the one specified in the documentation, but I'm using it to simulate the calculated field (and it yields the same results). I've seen this use of eval elsewhere but only for very simple things.

When I run:

stats sum(eval((bytes/(1024*1024)))) as MB

, it works. However, when I run

stats sum(eval(round(bytes/(1024*1024),2))) as MB

I get results, but they are totally inconsistent.

What could be happening? Where is my mistake? (Note that I'm not looking for the correct solution - I already have it - but I want to understand why this syntax doesn't work.)

Thanks.

[PickleRick · Accepted solution]

Rounding errors?

When you're doing

stats sum(eval(round(bytes/(1024*1024),2))) as MB

You lose some part of the value since you're "cutting off" the part after two decimal digits.

So the error is expected.

[FromTheGraves]

Okay, good point, I must have left my brain somewhere far away...

Indeed, max(bytes) is 47KB and avg is 2KB, less than 1MB!

Thank you all for your responsiveness.

[ITWhisperer]

In what way are they inconsistent? (The totals are most likely different due to the rounding)

[apietsch]

Interesting... Is it a different result every time you run it or at least the same different results for the same input?