Hi,
Sorry, i don't have the permissions to add comment!
I do not have any problems when i run your search. It is either your version of splunk or your search before pipe? I run this search index=values | chart values(price) by _time
the results display like this in splunk 6.1.4:
time values(price)
2015-01-16 14:12:07 7.75372
7.75373
7.75374
It's okay not to post a comment, because this is correct. values
does not truncate anything. Take this run everywhere example and see for yourself that the KBPS are mostly numbers around 0.[\d]{6}
(that is a null point followed by 6 digits)
index=_internal earliest=-7d@d latest=-1d@d | timechart span=1min values(kbps) AS KBPS
cheers, MuS
it is not a multi valued field, using list(price) does not change anything. Splunk is really bad at handling raw data.
I can't seem to duplicate this problem. Are you sure that the values are what you think they are before you get to the chart
command?
If they are, then what happens if you explicitly declare the precision?
...your search... | eval actualprice=round(price,5) | chart values(actualprice) by _time
The price is a multivalued field? What happens when you use "list" instead of "values"?