topic Re: How to calculate variance in an array? in Splunk Search

How to calculate variance in an array?

dtakacssplunk — Fri, 21 Apr 2023 18:16:08 GMT

I would like to create a column that tells me the variance for the array

| makeresults | eval raw="1 session1 O1 S1 5 6 7 9# 2 session2 O2 S2 99 55 77 999# 3 session3 O1 S1 995 55 77 999# 4 session4 O1 S1 1 2 4 1#" | makemv raw delim="#" | mvexpand raw | rename raw as _raw | rex "(?<User>\S+)\s+(?<ClientSession>\S+)\s+(?<Organization>\S+)\s+(?<Section>\S+)\s+(?<downloadspeed_file1>\S+)\s+(?<downloadspeed_file2>\S+)\s+(?<downloadspeed_file3>\S+)\s+(?<downloadspeed_file4>\S+)" | eval downloadSpeedsArray=json_array(downloadspeed_file1, downloadspeed_file2, downloadspeed_file3, downloadspeed_file4) | table User ClientSession Organization Section downloadspeed_file1, downloadspeed_file2, downloadspeed_file3, downloadspeed_file4 downloadSpeedsArray variance

can you please help me how to calculate this column. Is the variance normalized across rows?

Re: How to calculate variance in an array?

richgalloway — Fri, 21 Apr 2023 18:17:45 GMT

I think you'll need to write an external command for that.

Re: How to calculate variance in an array?

dtakacssplunk — Fri, 21 Apr 2023 18:20:33 GMT

how do I do that? I'm not familiar with external functions.

Re: How to calculate variance in an array?

richgalloway — Fri, 21 Apr 2023 18:23:17 GMT

There's too much to it to get into here, but Splunk has documentation on the subject. See https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/