why is the values() function truncating or rounding my field values?

[skinnygav]

Hi, my price field has values 7.75372, 7.75373, 7.75375. If i pipe these results to chart values(price) by _time it charts all values as 7.754. Why is it doing this and how do i stop it from happening? I want to chart the raw values.

[ngatchasandra]

Hi,
Sorry, i don't have the permissions to add comment!
I do not have any problems when i run your search. It is either your version of splunk or your search before pipe? I run this search index=values | chart values(price) by _time the results display like this in splunk 6.1.4:

time                                       values(price)
2015-01-16 14:12:07                           7.75372
                                              7.75373
                                              7.75374

[MuS]

It's okay not to post a comment, because this is correct. values does not truncate anything. Take this run everywhere example and see for yourself that the KBPS are mostly numbers around 0.[\d]{6} (that is a null point followed by 6 digits)

index=_internal earliest=-7d@d latest=-1d@d | timechart span=1min values(kbps) AS KBPS

cheers, MuS

[skinnygav]

it is not a multi valued field, using list(price) does not change anything. Splunk is really bad at handling raw data.

[aweitzman]

I can't seem to duplicate this problem. Are you sure that the values are what you think they are before you get to the chart command?

If they are, then what happens if you explicitly declare the precision?

...your search... | eval actualprice=round(price,5) | chart values(actualprice) by _time

[somesoni2]

The price is a multivalued field? What happens when you use "list" instead of "values"?