Splunk Search

Product of a Column

kalverra
New Member

I'm trying to find a simple way to calculate the product of a single column, e.g.

value_a
0.44
0.25
0.67

Ideally, I could use something like this:

| stats product(value_a)

 But this doesn't seem possible.

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Another approach is to (almost) use stats:-) as you original proposed.  With a little help of foreach.

 

| stats values(value_a) as value_a
| eval product = 1
| foreach value_a mode=multivalue
    [eval product = product * <<ITEM>>]

 

Here is an emulation you can play with and compare with real data:

 

| makeresults format=csv data="value_a
0.44
0.25
0.67"
``` data emulation above ```

 

The above search gives this result

value_a
product
0.25
0.44
0.67
0.074
Tags (1)
0 Karma

tscroggins
Influencer

I would use list() instead of values() to prevent removal of duplicates and wrap the product in exact() to prevent rounding errors:

| makeresults format=csv data="value_a
0.44
0.25
0.67
0.44" 
| stats list(value_a) as value_a
| eval "product(value_a)"=1
| foreach value_a mode=multivalue [ eval "product(value_a)"=exact('product(value_a)' * <<ITEM>>) ]
| table "product(value_a)"

 =>

product(value_a)
0.032428
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct, you can't multiply down columns, but you can with rows, so depending on how many events and columns you want the product of, you could do something like this

| makeresults format=csv data="value_a,value_b,otherValue
0.44,1,10
0.25,2,20
0.67,3,30"
| appendpipe
    [| transpose 0
    | eval product = 1
    | foreach row*
        [eval product = product * '<<FIELD>>']
    | eval {column} = product
    | stats values(value_a) as value_a values(value_b) as value_b]
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...