Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Given log data, can I calculate accuracy and output it in a dashboard?

$
0
0
Hello, My events look like this: 2019-10-10T17:51:40+00:00 action="updateDate->saveDatesFromDataMining", 0={"urlupdateid":1371955,"datetype":"Review date","datevalue":"10/03/2019"}, 1={"urlupdateid":1371955,"datetype":"somethingElse","datevalue":"10/03/2020"}, 2={"urlupdateid":1371955,"datetype":"False datetype","datevalue":"10/03/2019"},` approved=true host = stuff.localsource = PCDAccuracy.txtsourcetype = Text 2019-10-10T17:51:40+00:00 action="updateDate->saveDates", 0={"urlupdateid":1371955,"datetype":"Review date","datevalue":"10/03/2019"}, 1={"urlupdateid":1371955,"datetype":"Next review date (est.)","datevalue":"10/03/2020"}, approved=true host = stuff.localsource = PCDAccuracy.txtsourcetype = Text My question is, can I create a query that looks at every 0, 1, 2... N field in the event where action="updateDate->saveDatesFromDataMining" and checks to see if there is a corresponding entry in the most recent event where action="updateDate->saveDates" that has a matching datetype and datevalue, and then calculates the overall accuracy? So in the example above, accuracy would be 1/3 (0th entry is correct, 1st entry is incorrect, 2nd entry is extra and therefore incorrect) Accuracy = # of correctly extracted dates where action = "updateDate->saveDatesFromDataMining" / (# of dates where action = "updateDate->saveDates") UNION (# of extra dates where action = "updateDate->saveDatesFromDataMining")

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>