After the base search such as:
......
| stats sum(r1) as t_r1 sum(r2) as t_r2 sum(duras) as total_dura c(member) as samples by group
| eval ratio1 = t_r1/total_dura
| eval ratio2 = t_r2/total_dura
| table group ratio1 ratio2 samples
I got the table like below:
group ratio1 ratio2 samples
---------------------------------------------------------------
A 0.8 0.2 100
B 0.3 0.7 50
C 0.5 0.5 300
Then, I can calculate simple average over group by: | stats avg(ratio1) avg(ratio2)
.
Could someone help me how to calculate weighted average by using samples?
i.e., the weight for A is 100/(100+50+300), B is 50/(100+50+300),...
You can use eventstats
to achieve this
|eventstats sum(samples) as total | eval weighted_avg=samples/total
You can use by
clause in eventstats to group the records
Thank you very much, it worked!
Excuse me, my question is rather ambiguous. I would like to add something for beginners like me...
To get weighted-average finally, after eventstats
, the following commands can be added.
| eval w_avg_of_ratio1_per_group = ratio1*samples/total
| stats sum(w_avg_of_ratio1_per_group) as w_avg_of_ratio1
You can use eventstats
to achieve this
|eventstats sum(samples) as total | eval weighted_avg=samples/total
You can use by
clause in eventstats to group the records