Splunk Search

Find all possible combinations with two different data sets

inmanr
Engager

Using the below sample search I'm trying to get every possible combination of results between two different sets of data and interested if there are any good techniques for doing so that are relatively efficient.  At least with the production data set I'm working with it should translate to about 40,000 results.  Below is just an example to make the data set easier to understand.  Thank you in advance for any assistance.

Sample search


| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline


Output should be roughly in the format below and I'm stuck on getting the data manipulated in a way that aligns with the below.

new_set - baseline
--
A-X
A-Y
A-Z
B-X
B-Y
B-Z
C-X
C-Y
C-Z

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

One way using stats, which will be efficient

| makeresults
| eval new_set="A,B,C"
| makemv delim="," new_set
| append
[| makeresults
| eval baseline="X,Y,Z" ]
| makemv delim="," baseline
``` Join rows together ```
| stats values(*) as * 
``` Expand out the baseline data ```
| stats values(*) as * by baseline
``` Collect combinations ```
| eval combinations=mvmap(new_set, new_set. "-". baseline)
``` and combine again ```
| stats values(combinations) as combinations

It relies on the expansion of the MV using stats by baseline - which could also be done with mvexpand, not sure which one is more efficient.

 

Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...