Using the below sample search I'm trying to get every possible combination of results between two different sets of data and interested if there are any good techniques for doing so that are relatively efficient. At least with the production data set I'm working with it should translate to about 40,000 results. Below is just an example to make the data set easier to understand. Thank you in advance for any assistance.
Sample search
| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
Output should be roughly in the format below and I'm stuck on getting the data manipulated in a way that aligns with the below.
new_set - baseline
--
A-X
A-Y
A-Z
B-X
B-Y
B-Z
C-X
C-Y
C-Z
One way using stats, which will be efficient
| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as *
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations
It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.
One way using stats, which will be efficient
| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as *
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations
It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.