Splunk Search

Find all possible combinations with two different data sets

inmanr
Engager

Using the below sample search I'm trying to get every possible combination of results between two different sets of data and interested if there are any good techniques for doing so that are relatively efficient.  At least with the production data set I'm working with it should translate to about 40,000 results.  Below is just an example to make the data set easier to understand.  Thank you in advance for any assistance.

Sample search


| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline


Output should be roughly in the format below and I'm stuck on getting the data manipulated in a way that aligns with the below.

new_set - baseline
--
A-X
A-Y
A-Z
B-X
B-Y
B-Z
C-X
C-Y
C-Z

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...