Hi, I'm new to Splunk, so I apologize if this question seems naive. While experimenting with calculated fields, I found some inconsistent results. Consequently, I removed these fields and tested directly in the search. I'm aware that the syntax I'm using here with eval is not the one specified in the documentation, but I'm using it to simulate the calculated field (and it yields the same results). I've seen this use of eval elsewhere but only for very simple things. When I run: stats sum(eval((bytes/(1024*1024)))) as MB , it works. However, when I run stats sum(eval(round(bytes/(1024*1024),2))) as MB I get results, but they are totally inconsistent. What could be happening? Where is my mistake? (Note that I'm not looking for the correct solution - I already have it - but I want to understand why this syntax doesn't work.) Thanks.
... View more
