How to calculate through elements in MV field?

DS904458 — Wed, 21 Dec 2022 09:35:19 GMT

I have a table like this

product_name	test_result	result_mv	calc_output
A	1	1 2 3	5
A	2	1 2 3	2
A	3	1 2 3	5
B	4	4 6 7	13
B	6	4 6 7	5
B	7	4 6 7	10

You can see thr MV field "result_mv".
Is the outcome of | eventstats list(test_result) by product_name

And I have a customized func, for example:
Σ( ( test_result - result_mv[index] ) ^2)

Example of function output (calc_output):
(1-1)^2 + (1-2)^2 + (1-3)^2 = 0+1+4 = 5
(2-1)^2 + (2-2)^2 + (2-3)^2 = 1+0+1 = 2
(3-1)^2 + (3-2)^2 + (3-3)^2 = 4+1+0 = 5

(4-4)^2 + (4-6)^2 + (4-7)^2 = 0+4+9 = 13
(6-4)^2 + (6-6)^2 + (6-7)^2 = 4+0+1 = 5
(7-4)^2 + (7-6)^2 + (7-7)^2 = 9+1+0 = 10

Bottom line, I need create the "calc_output" through "result_mv" by "product_name" .

Re: How to calculate through elements in MV field?

bowesmana — Wed, 21 Dec 2022 23:27:24 GMT

@DS904458

Use this eval on your example table data, which will create calc_output as in your example

| eval calc_output=sum(mvmap(result_mv, pow((test_result-result_mv),2)))

If you want to then get totals by product_name, use eventstats or stats as needed.

topic Re: How to calculate through elements in MV field? in Splunk Search

How to calculate through elements in MV field?

Re: How to calculate through elements in MV field?