Splunk Search

Find all possible combinations with two different data sets

inmanr
Engager

Using the below sample search I'm trying to get every possible combination of results between two different sets of data and interested if there are any good techniques for doing so that are relatively efficient.  At least with the production data set I'm working with it should translate to about 40,000 results.  Below is just an example to make the data set easier to understand.  Thank you in advance for any assistance.

Sample search


| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline


Output should be roughly in the format below and I'm stuck on getting the data manipulated in a way that aligns with the below.

new_set - baseline
--
A-X
A-Y
A-Z
B-X
B-Y
B-Z
C-X
C-Y
C-Z

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...