Splunk Search

Are counts form the cofilter command "symmetric"?

JacobPN
Path Finder

Hi all,

As I understand it, the cofilter command counts how many times pairs of items occur. If the same user views item A ánd item B then that is counted as a pair. these pairs are counted and in this way we can for example find what items are viewed together more often. See: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Cofilter

The command makes a table with columns:
Item 1, Item 1 user count, Item 2, Item 2 user count, Pair count

If my understanding is correct, this should mean that the resulting dataset should be completely symmetric under the interchange of the labels 1 and 2. However, if I do for example:

...
| cofilter user item
| stats dc("Item 1") dc("Item 2")

I get a different number of unique items in for the two columns. So what is the flaw in my understanding of the command? Or is there some "running out of memory"-issue that I'm not aware of?

Thank you!
Jacob

0 Karma
1 Solution

JacobPN
Path Finder

I think I found the answer to my own question:

The command is NOT symmetric. Instead every pair occurs only once. Seems logical thing in hindsight..

In other words, to find every item that users have viewed together with e.g. item 34, the correct search is

...
| cofilter user item
| search "Item 1" = 34 OR "Item 2" = 34

View solution in original post

0 Karma

JacobPN
Path Finder

I think I found the answer to my own question:

The command is NOT symmetric. Instead every pair occurs only once. Seems logical thing in hindsight..

In other words, to find every item that users have viewed together with e.g. item 34, the correct search is

...
| cofilter user item
| search "Item 1" = 34 OR "Item 2" = 34
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...