Splunk Search

Are counts form the cofilter command "symmetric"?

JacobPN
Path Finder

Hi all,

As I understand it, the cofilter command counts how many times pairs of items occur. If the same user views item A ánd item B then that is counted as a pair. these pairs are counted and in this way we can for example find what items are viewed together more often. See: https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Cofilter

The command makes a table with columns:
Item 1, Item 1 user count, Item 2, Item 2 user count, Pair count

If my understanding is correct, this should mean that the resulting dataset should be completely symmetric under the interchange of the labels 1 and 2. However, if I do for example:

...
| cofilter user item
| stats dc("Item 1") dc("Item 2")

I get a different number of unique items in for the two columns. So what is the flaw in my understanding of the command? Or is there some "running out of memory"-issue that I'm not aware of?

Thank you!
Jacob

0 Karma
1 Solution

JacobPN
Path Finder

I think I found the answer to my own question:

The command is NOT symmetric. Instead every pair occurs only once. Seems logical thing in hindsight..

In other words, to find every item that users have viewed together with e.g. item 34, the correct search is

...
| cofilter user item
| search "Item 1" = 34 OR "Item 2" = 34

View solution in original post

0 Karma

JacobPN
Path Finder

I think I found the answer to my own question:

The command is NOT symmetric. Instead every pair occurs only once. Seems logical thing in hindsight..

In other words, to find every item that users have viewed together with e.g. item 34, the correct search is

...
| cofilter user item
| search "Item 1" = 34 OR "Item 2" = 34
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...