Splunk Search

Find all possible combinations with two different data sets

inmanr
Engager

Using the below sample search I'm trying to get every possible combination of results between two different sets of data and interested if there are any good techniques for doing so that are relatively efficient.  At least with the production data set I'm working with it should translate to about 40,000 results.  Below is just an example to make the data set easier to understand.  Thank you in advance for any assistance.

Sample search


| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline


Output should be roughly in the format below and I'm stuck on getting the data manipulated in a way that aligns with the below.

new_set - baseline
--
A-X
A-Y
A-Z
B-X
B-Y
B-Z
C-X
C-Y
C-Z

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...