Archive
Highlighted

Normalizing (feature scaling) a datapoint

New Member

I have a search and I would like to normalize a data point so that I can use it effectively in conjunction with other data points to determine performance impact. In particular, I have a search that is essentially a stats count as hits ... by requestUri I need to know min(hits) and max(hits) in order to determine the normalized value, which I imagine would require preprocessing. Is this possible? See https://en.wikipedia.org/wiki/Feature_scaling if you're wondering what I'm trying to accomplish.

Tags (1)
0 Karma
Highlighted

Re: Normalizing (feature scaling) a datapoint

Esteemed Legend

Many times this is desirable because of too-broad a span of datapoint values to see on a chart. If this is your motivation, have you tried changing your Y-Axis to "log" scale? If you have to do it, you can pre-process using eventstats like this:

... | stats count as hits ... BY requestUri | eventstats min(hits) AS minHits max(hits) AS maxHits | eval hitsPrime=(hits-minHits)/(maxHits-minHits)

View solution in original post

Highlighted

Re: Normalizing (feature scaling) a datapoint

New Member

This is exactly what I needed. Thank you!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.