Splunk Search

How to calculate through elements in MV field?

DS904458
Explorer

I have a table like this

product_nametest_resultresult_mvcalc_output
A11
2
3
5
A21
2
3
2
A31
2
3
5
B44
6
7
13
B64
6
7
5
B74
6
7
10

 

You can see thr MV field "result_mv".
Is the outcome of   | eventstats list(test_result) by product_name

And I have a customized func, for example:
Σ( ( test_result - result_mv[index] ) ^2)

Example of function output (calc_output):
(1-1)^2 + (1-2)^2 + (1-3)^2 = 0+1+4 = 5
(2-1)^2 + (2-2)^2 + (2-3)^2 = 1+0+1 = 2
(3-1)^2 + (3-2)^2 + (3-3)^2 = 4+1+0 = 5

(4-4)^2 + (4-6)^2 + (4-7)^2 = 0+4+9 = 13
(6-4)^2 + (6-6)^2 + (6-7)^2 = 4+0+1 = 5
(7-4)^2 + (7-6)^2 + (7-7)^2 = 9+1+0 = 10

Bottom line, I need create the "calc_output" through "result_mv" by "product_name" .

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

@DS904458 

Use this eval on your example table data, which will create calc_output as in your example

| eval calc_output=sum(mvmap(result_mv, pow((test_result-result_mv),2)))

 If you want to then get totals by product_name, use eventstats or stats as needed. 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@DS904458 

Use this eval on your example table data, which will create calc_output as in your example

| eval calc_output=sum(mvmap(result_mv, pow((test_result-result_mv),2)))

 If you want to then get totals by product_name, use eventstats or stats as needed. 

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...