topic Re: Correlate multivalues and count each relation to other values in Splunk Search

Correlate multivalues and count each relation to other values

Lithyum — Mon, 17 Jul 2023 10:53:31 GMT

Hi.

I need help in understanding how this can be done:

The application's log have a multivalue like this:

<somedata> [field1=A,B,C] <someotherdata>
<somedata> [field1=A,C] <someotherdata>
<somedata> [field1=E,F] <someotherdata>

And I need to find correlations between these values.

I'm looking to have something like:

field1mv  inConjunctionWith  count
      A              <all>      2
      A                  C      2
      A                  B      1
      B              <all>      1
      B                  A      1
      C              <all>      2
      C                  A      2
      C                  B      1
      E              <all>      1
      E                  F      1
      F              <all>      1
      F                  E      1

This way it'll be possible to identify that A+C, and E+F, have the same occurrences and probably are always together; also it'll show which values are the most common.

I feel I should be able to pull this off with mvmap but can't make my brain produce the actual process to it.

Re: Correlate multivalues and count each relation to other values

ITWhisperer — Mon, 17 Jul 2023 11:42:11 GMT

Re: Correlate multivalues and count each relation to other values

Lithyum — Mon, 17 Jul 2023 12:52:27 GMT

Thanks ITWhisperer.

The mvexpand was the kicker! 😀