Splunk Search

Weighted Sum

cafan
New Member

Hi,

I'm new to splunk and am hoping to get some advice and help.

I'm trying to do a addcoltotals but with different weights for each row. After a table function my data looks like:

Size Index
Large 0.45
Medium 0.7
Small 0.9

I want to do a weighted summation with specific values (I've bolded them below - these values are constant):

totalIndex = 0.2 X (Index[Size="Large"])+ 0.7 X (Index[Size="Medium"]) + 0.1 X (Index[Size="Small"])

After I should have one stat value = 0.2 X 0.45 + 0.7 X 0.7 + 0.1 X 0.9 = 0.67

Thank you!

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

try this:

<table with Size and Index>| foreach Size 
    [ eval Index=case(<<FIELD>>=="Large",round(Index*0.2,3),<<FIELD>>=="Medium",round(Index*0.7,3),<<FIELD>>=="Small",round(Index*0.1,3))] 
|  stats sum(Index)

OR

simple

| table Size Index 
| eval Index=case(Size=="Large",round(Index*0.2,2),Size=="Medium",round(Index*0.7,2),Size=="Small",round(Index*0.1,2)) 
| stats sum(Index)

View solution in original post

0 Karma

arjunpkishore5
Motivator

try this

| eval w_Index= Index*case(Size=="Large", 0.2, Size=="Medium", 0.7, Size=="Small", 0.1) 
| addcoltotals

If you don't need the original Index values

| eval Index= Index*case(Size=="Large", 0.2, Size=="Medium", 0.7, Size=="Small", 0.1) 
| addcoltotals
0 Karma

cafan
New Member

Thank you!

0 Karma

mayurr98
Super Champion

try this:

<table with Size and Index>| foreach Size 
    [ eval Index=case(<<FIELD>>=="Large",round(Index*0.2,3),<<FIELD>>=="Medium",round(Index*0.7,3),<<FIELD>>=="Small",round(Index*0.1,3))] 
|  stats sum(Index)

OR

simple

| table Size Index 
| eval Index=case(Size=="Large",round(Index*0.2,2),Size=="Medium",round(Index*0.7,2),Size=="Small",round(Index*0.1,2)) 
| stats sum(Index)
0 Karma

cafan
New Member

Thanks so much! It worked

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...