Splunk Search

Normalizing (feature scaling) a datapoint

bgourlie
New Member

I have a search and I would like to normalize a data point so that I can use it effectively in conjunction with other data points to determine performance impact. In particular, I have a search that is essentially a stats count as hits ... by requestUri I need to know min(hits) and max(hits) in order to determine the normalized value, which I imagine would require preprocessing. Is this possible? See https://en.wikipedia.org/wiki/Feature_scaling if you're wondering what I'm trying to accomplish.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Many times this is desirable because of too-broad a span of datapoint values to see on a chart. If this is your motivation, have you tried changing your Y-Axis to "log" scale? If you have to do it, you can pre-process using eventstats like this:

... | stats count as hits ... BY requestUri | eventstats min(hits) AS minHits max(hits) AS maxHits | eval hitsPrime=(hits-minHits)/(maxHits-minHits)

View solution in original post

woodcock
Esteemed Legend

Many times this is desirable because of too-broad a span of datapoint values to see on a chart. If this is your motivation, have you tried changing your Y-Axis to "log" scale? If you have to do it, you can pre-process using eventstats like this:

... | stats count as hits ... BY requestUri | eventstats min(hits) AS minHits max(hits) AS maxHits | eval hitsPrime=(hits-minHits)/(maxHits-minHits)

bgourlie
New Member

This is exactly what I needed. Thank you!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...