topic Lookup using multiple parameters in Splunk Search

Lookup using multiple parameters

daskuntal — Mon, 28 Sep 2020 11:30:25 GMT

Hi,

I'm trying to do a p-value lookup in the Z-Table, for calculating a statistical significant problem. Unfortunately, to do a p-value lookup in the Z-table, I need two entries: the column & the row. Is it possible to do such a lookup in Splunk, if so, how?

e.g.:
Z = 2.54
Z_row value = 2.50
Z_column_value = 0.04
Corresponding p-value(for a 1-tailed t-test), as looked up in the Z-table = 0.99446.

How can I do this simple lookup using both the row index & the column index?

Thanks

Re: Lookup using multiple parameters

gkanapathy — Mon, 12 Mar 2012 22:38:54 GMT

All lookups can take multiple input parameters. If you are using a scripted lookup, you are writing a program that can do whatever it wants with the input parameters, so that's not a problem. With file lookups, the file is a CSV format, so you'd have to flatten your table out. e.g., instead of a table like:

c1,c2,c3
1,2,3
4,5,6
7,8,9

You would have:

r_num,c_num,val
1,1,1
1,2,2
1,3,3
2,1,4
2,2,5
2,2,6
3,1,7
3,2,8
3,3,9

Re: Lookup using multiple parameters

daskuntal — Tue, 13 Mar 2012 18:35:44 GMT

Thanks for the response. If I do indeed needed to transform my matrix table into a linear csv format. It took me a while, but I eventually got to it.