Splunk Search

two queries, same result....

DTERM
Contributor

Does the following produce the same results?

... | transaction A B | max C
... | transaction A B eval ceil(C)

I believe it should but please confirm...

Thanks.

Tags (1)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

eval max() and eval ceil() do not give the same results. Max will give you the max number including decimals. ceil() rounds off whatever value it gets to the highest whole number.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

eval max() and eval ceil() do not give the same results. Max will give you the max number including decimals. ceil() rounds off whatever value it gets to the highest whole number.

DTERM
Contributor

Thanks for clarifying...

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...