<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Convert long table to confusion matrix in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Convert-long-table-to-confusion-matrix/m-p/554786#M157466</link>
    <description>&lt;P&gt;Would something like this work for you?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults
| eval _raw="unchanged,true,pred
A,,
B,,
,A,B
,C,A
A,,
C,,
,C,B
,C,A
B,,
B,,
,A,C
,C,B
A,,
A,,
,A,C
,B,C"
| multikv forceheader=1
| table unchanged true pred



| eval predicted=coalesce(unchanged,pred)
| eval actual=coalesce(true,unchanged)
| stats count by predicted actual
| xyseries actual predicted count&lt;/LI-CODE&gt;</description>
    <pubDate>Mon, 07 Jun 2021 21:43:03 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2021-06-07T21:43:03Z</dc:date>
    <item>
      <title>Convert long table to confusion matrix</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Convert-long-table-to-confusion-matrix/m-p/554782#M157465</link>
      <description>&lt;P&gt;I am looking to create a confusion matrix out of a tabled query of the form&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;[query] | table unchanged true pred&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;Where, due to circumstances upstream from me, &lt;FONT face="courier new,courier"&gt;unchanged&lt;/FONT&gt; is the result if the prediction was correct, &lt;FONT face="courier new,courier"&gt;true&lt;/FONT&gt; is the ground truth if the prediction was wrong and &lt;FONT face="courier new,courier"&gt;pred&lt;/FONT&gt; is the prediction if the prediction is wrong. Example tabular output, assuming categories are A, B, C:&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;unchanged | true | pred&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;A |&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;B |&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;&amp;nbsp; | A | B&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;&amp;nbsp; | C | A&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;etc.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I would like to accumulate the counts into a confusion matrix. So let's say the classifier categories are A, B, C. The table should count the matches from "unchanged" along the diagonal and put "pred" and "true" into the appropriate off-diagonal. Example table:&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;pred: &amp;nbsp; A&amp;nbsp;&amp;nbsp; B&amp;nbsp;&amp;nbsp; C&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;true:&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;A&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; 12&amp;nbsp; 6&amp;nbsp;&amp;nbsp; 1&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;B&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; 6&amp;nbsp;&amp;nbsp; 20&amp;nbsp; 2&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;C&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; 2&amp;nbsp;&amp;nbsp; 3&amp;nbsp;&amp;nbsp; 30&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;&lt;FONT face="arial,helvetica,sans-serif"&gt;If you are familiar with confusion matrices you will have the idea. How can I generate such a summary table?&lt;/FONT&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 07 Jun 2021 21:23:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Convert-long-table-to-confusion-matrix/m-p/554782#M157465</guid>
      <dc:creator>ebarnhill</dc:creator>
      <dc:date>2021-06-07T21:23:34Z</dc:date>
    </item>
    <item>
      <title>Re: Convert long table to confusion matrix</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Convert-long-table-to-confusion-matrix/m-p/554786#M157466</link>
      <description>&lt;P&gt;Would something like this work for you?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| makeresults
| eval _raw="unchanged,true,pred
A,,
B,,
,A,B
,C,A
A,,
C,,
,C,B
,C,A
B,,
B,,
,A,C
,C,B
A,,
A,,
,A,C
,B,C"
| multikv forceheader=1
| table unchanged true pred



| eval predicted=coalesce(unchanged,pred)
| eval actual=coalesce(true,unchanged)
| stats count by predicted actual
| xyseries actual predicted count&lt;/LI-CODE&gt;</description>
      <pubDate>Mon, 07 Jun 2021 21:43:03 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Convert-long-table-to-confusion-matrix/m-p/554786#M157466</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2021-06-07T21:43:03Z</dc:date>
    </item>
  </channel>
</rss>

