Splunk Search

Weighted Sum

cafan
New Member

Hi,

I'm new to splunk and am hoping to get some advice and help.

I'm trying to do a addcoltotals but with different weights for each row. After a table function my data looks like:

Size Index
Large 0.45
Medium 0.7
Small 0.9

I want to do a weighted summation with specific values (I've bolded them below - these values are constant):

totalIndex = 0.2 X (Index[Size="Large"])+ 0.7 X (Index[Size="Medium"]) + 0.1 X (Index[Size="Small"])

After I should have one stat value = 0.2 X 0.45 + 0.7 X 0.7 + 0.1 X 0.9 = 0.67

Thank you!

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

try this:

<table with Size and Index>| foreach Size 
    [ eval Index=case(<<FIELD>>=="Large",round(Index*0.2,3),<<FIELD>>=="Medium",round(Index*0.7,3),<<FIELD>>=="Small",round(Index*0.1,3))] 
|  stats sum(Index)

OR

simple

| table Size Index 
| eval Index=case(Size=="Large",round(Index*0.2,2),Size=="Medium",round(Index*0.7,2),Size=="Small",round(Index*0.1,2)) 
| stats sum(Index)

View solution in original post

0 Karma

arjunpkishore5
Motivator

try this

| eval w_Index= Index*case(Size=="Large", 0.2, Size=="Medium", 0.7, Size=="Small", 0.1) 
| addcoltotals

If you don't need the original Index values

| eval Index= Index*case(Size=="Large", 0.2, Size=="Medium", 0.7, Size=="Small", 0.1) 
| addcoltotals
0 Karma

cafan
New Member

Thank you!

0 Karma

mayurr98
Super Champion

try this:

<table with Size and Index>| foreach Size 
    [ eval Index=case(<<FIELD>>=="Large",round(Index*0.2,3),<<FIELD>>=="Medium",round(Index*0.7,3),<<FIELD>>=="Small",round(Index*0.1,3))] 
|  stats sum(Index)

OR

simple

| table Size Index 
| eval Index=case(Size=="Large",round(Index*0.2,2),Size=="Medium",round(Index*0.7,2),Size=="Small",round(Index*0.1,2)) 
| stats sum(Index)
0 Karma

cafan
New Member

Thanks so much! It worked

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...