https://community.splunk.com/t5/Splunk-Search/Searching-intersection-of-two-subsets/m-p/12748#M1069 <P>There is a way to do this in Splunk using the <CODE>set</CODE> commands ( <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Set" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/Set</A> ) , but it is likely that there is a far more efficient way to do it without the <CODE>set</CODE> command or a bunch of subsearches. (By filtering the data all at once, and then doing <CODE>... | top 5 by subsetname | stats count by commonfield</CODE>, but whether this is possible depends on the specific conditions and the data). </P> <P>In general, it may be a good idea to give examples or describe what your incoming data is and what you want out, rather that specifying the specific algorithm, because a lot of set-based/table-based algorithms may be replaced with better algorithms that take better advantage of how Splunk processes data.</P> Mon, 03 May 2010 05:51:54 GMT gkanapathy 2010-05-03T05:51:54Z https://community.splunk.com/t5/Splunk-Search/Searching-intersection-of-two-subsets/m-p/12747#M1068 <P>Hello Splunkers,</P> <P>Thanks to visit my question.</P> <P>I have two subsets of data related to each other.</P> <OL> <LI>The set A consists of 50 items. Of these, only top 5 items interests me (subset AA'),assessed a condition.</LI> <LI>The set B contains 25 items. Of these, only top 5 items interests me (subset BB'),assessed a condition.</LI> </OL> <P><STRONG>My goal is:</STRONG></P> <OL> <LI>search for the top 5 elements of AA ', once assessed a condition. </LI> <LI>search for the top 5 elements of B, once assessed a required condition.</LI> <LI>Count how many intersections have the elements of AA ' with each of the top 5 elements of BB'.</LI> <LI>(subsearch AA') AND (subsearch BB') <STRONG>gives different results if</STRONG> (subsearch BB') AND (subsearch AA')</LI> </OL> <P>Can someone kindly suggest me how to build that search using only the subsearches?</P> <P>Thanks in advance.</P> <P>Nik (currently working on splunk 4.0.9)</P> Sun, 02 May 2010 01:13:41 GMT https://community.splunk.com/t5/Splunk-Search/Searching-intersection-of-two-subsets/m-p/12747#M1068 nik_splunk 2010-05-02T01:13:41Z https://community.splunk.com/t5/Splunk-Search/Searching-intersection-of-two-subsets/m-p/12748#M1069 <P>There is a way to do this in Splunk using the <CODE>set</CODE> commands ( <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Set" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/Set</A> ) , but it is likely that there is a far more efficient way to do it without the <CODE>set</CODE> command or a bunch of subsearches. (By filtering the data all at once, and then doing <CODE>... | top 5 by subsetname | stats count by commonfield</CODE>, but whether this is possible depends on the specific conditions and the data). </P> <P>In general, it may be a good idea to give examples or describe what your incoming data is and what you want out, rather that specifying the specific algorithm, because a lot of set-based/table-based algorithms may be replaced with better algorithms that take better advantage of how Splunk processes data.</P> Mon, 03 May 2010 05:51:54 GMT https://community.splunk.com/t5/Splunk-Search/Searching-intersection-of-two-subsets/m-p/12748#M1069 gkanapathy 2010-05-03T05:51:54Z