ok after some unsuccessful attempts at using addterm instead of stringreplace (for which I found documentation lacking..), I got it working by using tonumber function ie. before fix: index=perf sourcetype=snmp | bucket _time span=1m | stats avg(dpStatusSystemUsageLoad) as "AvgLoad" by host,_time | eval BaseLoad=$baseload$ after fix: index=perf sourcetype=snmp | bucket _time span=1m | stats avg(dpStatusSystemUsageLoad) as "AvgLoad" by host,_time | eval BaseLoad=tonumber("$baseload$",10) ... View more