topic Re: Weighted Sum in Splunk Search

Weighted Sum

cafan — Thu, 07 Nov 2019 15:26:43 GMT

Hi,

I'm new to splunk and am hoping to get some advice and help.

I'm trying to do a addcoltotals but with different weights for each row. After a table function my data looks like:

Size Index
Large 0.45
Medium 0.7
Small 0.9

I want to do a weighted summation with specific values (I've bolded them below - these values are constant):

totalIndex = 0.2 X (Index[Size="Large"])+ 0.7 X (Index[Size="Medium"]) + 0.1 X (Index[Size="Small"])

After I should have one stat value = 0.2 X 0.45 + 0.7 X 0.7 + 0.1 X 0.9 = 0.67

Thank you!

Re: Weighted Sum

mayurr98 — Thu, 07 Nov 2019 17:21:52 GMT

try this:

<table with Size and Index>| foreach Size 
    [ eval Index=case(<<FIELD>>=="Large",round(Index*0.2,3),<<FIELD>>=="Medium",round(Index*0.7,3),<<FIELD>>=="Small",round(Index*0.1,3))] 
|  stats sum(Index)

simple

| table Size Index 
| eval Index=case(Size=="Large",round(Index*0.2,2),Size=="Medium",round(Index*0.7,2),Size=="Small",round(Index*0.1,2)) 
| stats sum(Index)

Re: Weighted Sum

arjunpkishore5 — Thu, 07 Nov 2019 17:41:05 GMT

try this

| eval w_Index= Index*case(Size=="Large", 0.2, Size=="Medium", 0.7, Size=="Small", 0.1) 
| addcoltotals

If you don't need the original Index values

| eval Index= Index*case(Size=="Large", 0.2, Size=="Medium", 0.7, Size=="Small", 0.1) 
| addcoltotals

Re: Weighted Sum

cafan — Fri, 08 Nov 2019 08:59:44 GMT

Thanks so much! It worked

Re: Weighted Sum

cafan — Fri, 08 Nov 2019 08:59:56 GMT

Thank you!