addcoltotals

It's a pretty popular search command and it is used in all sorts of situations. Below are some really cool searches that use addcoltotals along with other search commands.

Pearson Correlation Coefficient

index=*
| fields x y
| eval n=1 | eval xx=x*x | eval xy=x*y | eval yy=y*y
| addcoltotals  | tail 1
| eval rho_xy=(xy/n-x/n*y/n)/(sqrt(xx/n-(x/n)*(x/n))*sqrt(yy/n-(y/n)*(y/n)))
| fields rho_xy

purpose:

requirements:

comments:

This SPL query calculates the Pearson coefficient of two fields named x and y.