Howdy, I've got some very simple data and I'm running the following on it:
X1,2,3 all range both positive & negative, as well as including decimals.
Oddly, the above always gives the value of X2 for minX. However, if I change it to
where 1000000 is some number above all the other numbers, it works as I want it to and selects the minimum value of the 3 fields.
I'm not sure why adding the 4th value should change anything... any ideas?
Probably a bug. Try using
It is likely related to this: http://answers.splunk.com/questions/11523/getting-maximum-value-from-a-series-of-fields-not-working
One idea, is that in the docs it says that min(X,...) will actually operate on strings as well as numbers. It says specifically that strings sort higher than numbers.
However timechart and chart will always ignore values that are not numbers.
The difference is somewhat sensible -- timechart and chart, when you're using their numeric functions, are designed to 'graph' and 'chart' things so they silently filter out occasional non-numeric outliers. eval on the other hand is a much more general tool.
So one idea is to use the eval functions isnum() and tonumber() to see what you can find out anything weird about X2.
see if this changes anything --
and look for places where the second line drops below the count line. If there are any such places you may have your culprit.
answered 04 Mar '11, 17:02