https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560565#M159313 <LI-CODE lang="markup">| eval dv=mvmap(transactions,abs(transactions-median_transactions))</LI-CODE><P>By the way, values() will give you an ordered list of unique values, whereas list() will keep duplicates which may or may not be a consideration for you.</P> Fri, 23 Jul 2021 06:15:49 GMT ITWhisperer 2021-07-23T06:15:49Z https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560552#M159305 <P>HI,</P><P>As mentioned in the subject, I want to perform&nbsp;operations on a list of values with a single value. To be clearer, here's my search:</P><LI-CODE lang="markup">index="my_index" | stats limit=15 values(my_transaction) as transactions by group_name | eventstats median(transactions) as median_transaction by group_name | eval dv=(abs(transactions-median_transactions))</LI-CODE><P>However, "dv" is empty. I am assuming this is because "transactions" is an array/ a list while "median_transaction" is a a single value, for each group. If my assumption is correct, what's the best way in performing the operation for each value in "transactions" with "median_transaction" for each group?&nbsp;</P> Fri, 23 Jul 2021 04:05:49 GMT https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560552#M159305 jaysonpryde 2021-07-23T04:05:49Z https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560561#M159310 <P>Hi please try this:</P><LI-CODE lang="markup">index="my_index" | eventstats median(transactions) as by group_name | stats limit=15 values(my_transaction) as transactions values(median_transaction) AS median_transaction by group_name | eval dv=(abs(transactions-median_transactions))</LI-CODE><P>One question: do you want the 15 first values ordered by group name or transactions?</P><P>with your search you have the 15 first values ordered by group name, if you want the 15 first values by transactions, you have to use head:</P><LI-CODE lang="markup">index="my_index" | eventstats median(transactions) as by group_name | stats values(my_transaction) as transactions values(median_transaction) AS median_transaction by group_name | sort transactios | head 15 | eval dv=(abs(transactions-median_transactions))</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Fri, 23 Jul 2021 05:58:38 GMT https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560561#M159310 gcusello 2021-07-23T05:58:38Z https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560565#M159313 <LI-CODE lang="markup">| eval dv=mvmap(transactions,abs(transactions-median_transactions))</LI-CODE><P>By the way, values() will give you an ordered list of unique values, whereas list() will keep duplicates which may or may not be a consideration for you.</P> Fri, 23 Jul 2021 06:15:49 GMT https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560565#M159313 ITWhisperer 2021-07-23T06:15:49Z https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560568#M159315 <P>Thank you very much&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P> Fri, 23 Jul 2021 07:17:04 GMT https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560568#M159315 jaysonpryde 2021-07-23T07:17:04Z https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560569#M159316 <P>Thank you very much&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>&nbsp;</P> Fri, 23 Jul 2021 07:17:32 GMT https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560569#M159316 jaysonpryde 2021-07-23T07:17:32Z https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560588#M159324 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/236743">@jaysonpryde</a>,</P><P>you're always welcome!</P><P>Ciao and happy splunking.</P><P>Giuseppe</P> Fri, 23 Jul 2021 10:19:30 GMT https://community.splunk.com/t5/Splunk-Search/Performing-operations-on-a-list-of-values-with-a-single-value/m-p/560588#M159324 gcusello 2021-07-23T10:19:30Z