I have values in a field that, when summed, are values less than 1 (ie, .79 .03). I need these values to display in my table, but they currently do not. I assume it is because they are a value less than 1. They display when they aren't summed, so is there a way to format a summed value so it will display these smaller values?
Seems like the value .03
is not recognized as proper decimal number. Give this a try
| eval Duration=if(substr(Duration,1,1)=".","0".Duration,Duration) | stats list(RFO) as RFO, list (DAYSOUT) as Duration, list(count) as COUNT, sum(count) as total tickets by sensor | convert num(Duration) |stats sum(Duration) as Duration by Sensor
Seems like the value .03
is not recognized as proper decimal number. Give this a try
| eval Duration=if(substr(Duration,1,1)=".","0".Duration,Duration) | stats list(RFO) as RFO, list (DAYSOUT) as Duration, list(count) as COUNT, sum(count) as total tickets by sensor | convert num(Duration) |stats sum(Duration) as Duration by Sensor
Thanks. This appears to have worked. Really appreciate it!
Splunk does not round or truncate numbers by default in any situations I'm aware of. Can you provide sample logs, searches and results?
Using round
or exact
in your eval may help. Show us your query for a better answer.
I'm basically just summing duration times for a particular device outage
|stats sum(Duration) as Duration by Sensor -- my search returns 3 values to sum [.03, 4.75, and 7.24] -- the result is 11.99, it seems to be ignoring the .03 value
Can you run this and share results (for the Sensor you're seeing issue)
your base search | table Sensor Duration | appendpipe [|stats sum(Duration) as Duration by Sensor]
I have all of that
base search, I did stats list(RFO) as RFO, list (DAYSOUT) as Duration, list(count) as COUNT, sum(count) as total tickets by sensor |appendpipe [|stats sum(Duration) as Duration by Sensor]
I get everything I want with the exception of any duration that is less than 1 is ignored. How do I get the sum functions to add the 0.something values?
I'm guessing the number format could be the issue here. Could you try this
stats list(RFO) as RFO, list (DAYSOUT) as Duration, list(count) as COUNT, sum(count) as total tickets by sensor | convert num(Duration) |appendpipe [|stats sum(Duration) as Duration by Sensor]
Same result. 11.99 when it should be 12.02