Hi, This thing is getting me crazy. I am running Splunk 9.2.1 and I have the following table: amount compare frac_type fraction integer 0.41 F Number 0.41 0 4.18 F Number 0....
See more...
Hi, This thing is getting me crazy. I am running Splunk 9.2.1 and I have the following table: amount compare frac_type fraction integer 0.41 F Number 0.41 0 4.18 F Number 0.18 4 0.26 F Number 0.26 0 0.34 F Number 0.34 0 10.60 F Number 0.60 10 0.11 F Number 0.11 0 2.00 F Number 0.00 2 3.49 F Number 0.49 3 10.58 F Number 0.58 10 2.00 F Number 0.00 2 1.02 F Number 0.02 1 15.43 F Number 0.43 15 1.17 F Number 0.17 1 And these are the evals I used to calculate the fields: | eval integer = floor(amount) | eval fraction = amount - floor(amount) | eval frac_type = typeof(fraction) | eval compare = if(fraction = 0.6, "T", "F") Now, I really can't understand how the "compare" field is always false.... I was expecting it to output TRUE on row 5 with amount = 10.60, which means fraction = 0.6, but it does not. What am I doing wrong here? Why "compare" evaluates to FALSE on row 5? I tried to change 0.6 with 0.60 (you never know), but no luck. If you want you can try this run anywhere search, which gives me the same result: | makeresults | eval amount = 10.6 | eval integer = floor(amount) | eval fraction = amount - floor(amount) | eval frac_type = typeof(fraction) | eval compare = if(fraction = 0.6, "T", "F") Can you help me? Thank you in advance, Tommaso