Hello,
I have a bucketed chart in this format:
Is it possible to calculate the geometric mean of the values in each timestamp and add it to another field??
Try this
.... | mvexpand solrTime | eval natural_logs=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)
Got this from this great post by @aljohnson
Try this
.... | mvexpand solrTime | eval natural_logs=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)
Got this from this great post by @aljohnson
Did not work.
I tried this command:
I don't believe you need the rex
command. Add this to the query that resulted in the table you have in your screenshot. Make sure the table has two columns _time
and solrTime
The query between --- is the initial one that generates that chart.
--- * | rex field=_raw ".*Solr Time: (?\d+)" | bucket span=10m _time | chart values(solrTime) by _time --- | mvexpand solrTime | eval natural_log=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)
After that, the results are returning only the timestamp.
Try this
--- | rex field=_raw ".*Solr Time: (?\d+)" | bucket span=10m _time | chart values(solrTime) as solrTime by _time | mvexpand solrTime | eval natural_log=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)
Still not working.
Try this. Fixed typo
--- | rex field=_raw ".*Solr Time: (?\d+)" | bucket span=10m _time | chart values(solrTime) as solrTime by _time | mvexpand solrTime | eval natural_logs=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)
If this doesn't work, try taking out one segment at a time to see where it stops working.
It's working now. Thanks a lot for your help. 😄