topic Re: How to calculate the factorial of a number in a Splunk search? in Splunk Search

How to calculate the factorial of a number in a Splunk search?

shrirangphadke — Thu, 11 Feb 2016 09:18:06 GMT

Hi,

I want to calculate factorial of a number in eval for calculating Poisson value.
Please let me know if it is possible.

Thanks,

Re: How to calculate the factorial of a number in a Splunk search?

ichaer_splunk — Thu, 11 Feb 2016 11:43:24 GMT

You can use a lookup table. Precompute as many factorials as you think you may need (probably not many, considering how quickly they grow) and then look them up as you need.

Re: How to calculate the factorial of a number in a Splunk search?

stanwin — Thu, 11 Feb 2016 13:14:53 GMT

The splunk eval functions dont offer factorial computator.

You could create a custom command & offload the factorial generation logic to the python code.

http://docs.splunk.com/Documentation/Splunk/6.2.3/AdvancedDev/Searchscripts

http://blogs.splunk.com/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-generating-command/

Re: How to calculate the factorial of a number in a Splunk search?

javiergn — Fri, 12 Feb 2016 13:23:46 GMT

You could try an approximation by using the natural logarithm (see formula in picture below).
That should work fine when n is not too big, if n is big enough you might have approximation errors. Using the Stirling's approximation is more accurate in this case but it won't be easy to implement with the Splunk built-in commands.

See an example below for the natural logarithm approximation when n=5:

| stats count
| fields - count
| eval n = 5
| eval ki = mvrange(1, n+1)
| mvexpand ki
| eval ln_ki = ln(ki)
| eventstats sum(ln_ki) as sum_ln_ki by n
| eval n_factorial = round(exp(sum_ln_ki))
| stats first(n_factorial) as n_factorial by n

Alternative that performs the exponential calculations at the end and might improve performance. Give it a go too:

| stats count
| fields - count
| eval n = 5
| eval ki = mvrange(1, n+1)
| mvexpand ki
| eval ln_ki = ln(ki)
| eventstats sum(ln_ki) as sum_ln_ki by n
| stats count by n, sum_ln_ki
| eval n_factorial = round(exp(sum_ln_ki))
| fields - count, sum_ln_ki

Re: How to calculate the factorial of a number in a Splunk search?

Richfez — Fri, 12 Feb 2016 13:43:48 GMT

You could try the App for R. It doesn't seem to be on Splunkbase any more, but it's apparently available from a link the_wolverine supplies in this answer for what happened to the R project. To help prevent double-hopping, here's the link they supplied: https://github.com/rfsp/r

Re: How to calculate the factorial of a number in a Splunk search?

javiergn — Mon, 15 Feb 2016 09:45:15 GMT

By the way, if you find a different answer that works for you please post it here so that others can benefit from it.

Re: How to calculate the factorial of a number in a Splunk search?

shrirangphadke — Tue, 16 Feb 2016 07:07:43 GMT

Hey thanks ! and sorry for late reply. Yes it did work for me. Also custom command option seems to be good

Re: How to calculate the factorial of a number in a Splunk search?

martin_mueller — Sun, 13 Sep 2020 11:49:44 GMT

Here's Stirling's Approximation in SPL: `| eval n! = sqrt(2*pi()*n)*pow(n/exp(1), n)`