Normalizing (feature scaling) a datapoint

[bgourlie]

I have a search and I would like to normalize a data point so that I can use it effectively in conjunction with other data points to determine performance impact. In particular, I have a search that is essentially a stats count as hits ... by requestUri I need to know min(hits) and max(hits) in order to determine the normalized value, which I imagine would require preprocessing. Is this possible? See https://en.wikipedia.org/wiki/Feature_scaling if you're wondering what I'm trying to accomplish.

[woodcock · Accepted solution]

Many times this is desirable because of too-broad a span of datapoint values to see on a chart. If this is your motivation, have you tried changing your Y-Axis to "log" scale? If you have to do it, you can pre-process using eventstats like this:

... | stats count as hits ... BY requestUri | eventstats min(hits) AS minHits max(hits) AS maxHits | eval hitsPrime=(hits-minHits)/(maxHits-minHits)

[bgourlie]

This is exactly what I needed. Thank you!