https://community.splunk.com/t5/Splunk-Search/Normalizing-feature-scaling-a-datapoint/m-p/194303#M187288 <P>I have a search and I would like to normalize a data point so that I can use it effectively in conjunction with other data points to determine performance impact. In particular, I have a search that is essentially a <CODE>stats count as hits ... by requestUri</CODE> I need to know <CODE>min(hits)</CODE> and <CODE>max(hits)</CODE> in order to determine the normalized value, which I imagine would require preprocessing. Is this possible? See <A href="https://en.wikipedia.org/wiki/Feature_scaling">https://en.wikipedia.org/wiki/Feature_scaling</A> if you're wondering what I'm trying to accomplish.</P> Wed, 26 Aug 2015 16:03:57 GMT bgourlie 2015-08-26T16:03:57Z https://community.splunk.com/t5/Splunk-Search/Normalizing-feature-scaling-a-datapoint/m-p/194303#M187288 <P>I have a search and I would like to normalize a data point so that I can use it effectively in conjunction with other data points to determine performance impact. In particular, I have a search that is essentially a <CODE>stats count as hits ... by requestUri</CODE> I need to know <CODE>min(hits)</CODE> and <CODE>max(hits)</CODE> in order to determine the normalized value, which I imagine would require preprocessing. Is this possible? See <A href="https://en.wikipedia.org/wiki/Feature_scaling">https://en.wikipedia.org/wiki/Feature_scaling</A> if you're wondering what I'm trying to accomplish.</P> Wed, 26 Aug 2015 16:03:57 GMT https://community.splunk.com/t5/Splunk-Search/Normalizing-feature-scaling-a-datapoint/m-p/194303#M187288 bgourlie 2015-08-26T16:03:57Z https://community.splunk.com/t5/Splunk-Search/Normalizing-feature-scaling-a-datapoint/m-p/194304#M187289 <P>Many times this is desirable because of too-broad a span of datapoint values to see on a chart. If this is your motivation, have you tried changing your Y-Axis to "log" scale? If you have to do it, you can pre-process using <CODE>eventstats</CODE> like this:</P> <PRE><CODE>... | stats count as hits ... BY requestUri | eventstats min(hits) AS minHits max(hits) AS maxHits | eval hitsPrime=(hits-minHits)/(maxHits-minHits) </CODE></PRE> Thu, 27 Aug 2015 14:30:35 GMT https://community.splunk.com/t5/Splunk-Search/Normalizing-feature-scaling-a-datapoint/m-p/194304#M187289 woodcock 2015-08-27T14:30:35Z https://community.splunk.com/t5/Splunk-Search/Normalizing-feature-scaling-a-datapoint/m-p/194305#M187290 <P>This is exactly what I needed. Thank you!</P> Thu, 27 Aug 2015 15:47:11 GMT https://community.splunk.com/t5/Splunk-Search/Normalizing-feature-scaling-a-datapoint/m-p/194305#M187290 bgourlie 2015-08-27T15:47:11Z