https://community.splunk.com/t5/Splunk-Search/Are-counts-form-the-cofilter-command-quot-symmetric-quot/m-p/308012#M164693 <P>Hi all, </P> <P>As I understand it, the cofilter command counts how many times pairs of items occur. If the same user views item A ánd item B then that is counted as a pair. these pairs are counted and in this way we can for example find what items are viewed together more often. See: <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Cofilter">https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Cofilter</A></P> <P>The command makes a table with columns:<BR /> Item 1, Item 1 user count, Item 2, Item 2 user count, Pair count</P> <P>If my understanding is correct, this should mean that the resulting dataset should be completely symmetric under the interchange of the labels 1 and 2. However, if I do for example:</P> <PRE><CODE>... | cofilter user item | stats dc("Item 1") dc("Item 2") </CODE></PRE> <P>I get a different number of unique items in for the two columns. So what is the flaw in my understanding of the command? Or is there some "running out of memory"-issue that I'm not aware of?</P> <P>Thank you!<BR /> Jacob</P> Wed, 29 Nov 2017 21:59:52 GMT JacobPN 2017-11-29T21:59:52Z https://community.splunk.com/t5/Splunk-Search/Are-counts-form-the-cofilter-command-quot-symmetric-quot/m-p/308012#M164693 <P>Hi all, </P> <P>As I understand it, the cofilter command counts how many times pairs of items occur. If the same user views item A ánd item B then that is counted as a pair. these pairs are counted and in this way we can for example find what items are viewed together more often. See: <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Cofilter">https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Cofilter</A></P> <P>The command makes a table with columns:<BR /> Item 1, Item 1 user count, Item 2, Item 2 user count, Pair count</P> <P>If my understanding is correct, this should mean that the resulting dataset should be completely symmetric under the interchange of the labels 1 and 2. However, if I do for example:</P> <PRE><CODE>... | cofilter user item | stats dc("Item 1") dc("Item 2") </CODE></PRE> <P>I get a different number of unique items in for the two columns. So what is the flaw in my understanding of the command? Or is there some "running out of memory"-issue that I'm not aware of?</P> <P>Thank you!<BR /> Jacob</P> Wed, 29 Nov 2017 21:59:52 GMT https://community.splunk.com/t5/Splunk-Search/Are-counts-form-the-cofilter-command-quot-symmetric-quot/m-p/308012#M164693 JacobPN 2017-11-29T21:59:52Z https://community.splunk.com/t5/Splunk-Search/Are-counts-form-the-cofilter-command-quot-symmetric-quot/m-p/308013#M164694 <P>I think I found the answer to my own question:</P> <P>The command is NOT symmetric. Instead every pair occurs only once. Seems logical thing in hindsight..</P> <P>In other words, to find every item that users have viewed together with e.g. item 34, the correct search is</P> <PRE><CODE>... | cofilter user item | search "Item 1" = 34 OR "Item 2" = 34 </CODE></PRE> Thu, 30 Nov 2017 12:43:13 GMT https://community.splunk.com/t5/Splunk-Search/Are-counts-form-the-cofilter-command-quot-symmetric-quot/m-p/308013#M164694 JacobPN 2017-11-30T12:43:13Z