Splunk Search

How to calculate row sum which each column has different weight?

hakusama1024
New Member

Hi

I have a table as below.

severity S0 S1 S2 S3
event A 1 0 0 0
event B 0 2 0 0
event C 0 1 1 0

each column has different weight. for example S0 = 1,000,000, S1 = 10,000, S2 = 100, S3 = 1. i want to sort the event based on the weight multiply by the event number.
Please advise.

Tags (3)
0 Karma
1 Solution

HeinzWaescher
Motivator

try this:

| eval weight=(S0*1000000 + S1*10000 + S2*100 + S3*1)
| sort 0 - weight

View solution in original post

HeinzWaescher
Motivator

try this:

| eval weight=(S0*1000000 + S1*10000 + S2*100 + S3*1)
| sort 0 - weight

hakusama1024
New Member

thank you sir.

0 Karma
Get Updates on the Splunk Community!

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...