What is the difference between these eval commands in a timechart?

[HeinzWaescher]

Hi,

I'm wondering why I'm getting different results here:

1.

... | timechart span=1d count(eval(if(value>"1", value, null()))) AS count

2.

... | timechart span=1d count(eval(if(value>="2", value, null()))) AS count

Can you help me?

BR
Heinz

[woodcock]

The count(STUFF) says, if "STUFF" for this event is NOT null, then add 1 to "count". The count(eval(STUFF)) says, if "STUFF" (in this case, it must be an equation) evaluates to "true", then add 1 to "count". So in your case, it is probably not doing what you are expecting because:

These 2 are equivalent to eachother:

... | timechart span=1d count(eval(if(value>"1", value, null()))) AS count
... | timechart span=1d count(eval(value>1)) AS count

And also these 2 are equivalent to eachother:

... | timechart span=1d count(eval(if(value>="2", value, null()))) AS count
... | timechart span=1d count(eval(value>=2)) AS count

Probably what you are trying to do is something like this:

... | eval modValue=if(value>1, value, null()) | timechart span=1d sum(modValue) AS modValueSum
... | eval modValue=if(value>=2, value, null()) | timechart span=1d sum(modValue) AS modValueSum

[hgrow · Accepted solution]

Hi Heinz,

value>=" 2 " leads to some sort of string comparison instead of value>= 2 wich is the correct numerical comparison. By using " " you transform your numerical value into a string, wich messes up the equation.

Greetings

[HeinzWaescher]

Oh, of course. Thanks a lot!

Cheers
Heinz

PS: I think you wanted to write value>=2.

[hgrow]

Indeed 😄 Just changed it.

Have a great day!