Splunk Search

Search Commands: analyzefields

mw
Splunk Employee
Splunk Employee

I'm trying to wrap my head around some of the more advanced/esoteric search commands. It seems like there's a lot of power there if you know how to harness it (i.e. you're familiar with statistics, probability, and data mining techniques). So, seeing as I'm very much a lay person, and the documentation is a little light sometimes, I'm hoping that someone can educate us all about this command, what it does exactly, and cases where it would be useful in the real-world. My ultimate hope is to post further questions like this about... well, a lot of the search commands, in order to augment the docs a bit and make us all more powerful splunkers. So, are you using this command and, if so, for what?

Here's a related post: Question about analyzefields search command

1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

AF helps you determine how accurately each field predicts the specified field. As an example, look at the following data:

02/03/2011 01:00,st=CA,state_no=1,vote_no=1
02/03/2011 14:00,st=CA,state_no=1,vote_no=1
02/03/2011 01:00,st=MA,state_no=2,vote_no=2
02/03/2011 02:00,st=MA,state_no=2,vote_no=2
02/03/2011 07:00,st=MO,state_no=4,vote_no=1
02/03/2011 08:00,st=MO,state_no=4,vote_no=1

If you run the following search:

* | af classfield=vote_no

You can see that there is a 100% chance (1.0) that my state (state_no) will predict my vote (vote_num), by looking at the accuracy field (acc). You can also see that state is always declared for a vote (cocur = 1).

The use case here is to determine if we can use the data to predict which state will vote for which candidate and with what accuracy we might make a prediction. This is too small a dataset to make accurate predictions, but given a much more representative dataset, I could, with reasonable confidence, predict that a CA or MO voter will pick candidate #1.

HTH
ron

View solution in original post

mw
Splunk Employee
Splunk Employee

If you have any searches which utilize this command, please chime in and let us know what it's doing for you.

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

AF helps you determine how accurately each field predicts the specified field. As an example, look at the following data:

02/03/2011 01:00,st=CA,state_no=1,vote_no=1
02/03/2011 14:00,st=CA,state_no=1,vote_no=1
02/03/2011 01:00,st=MA,state_no=2,vote_no=2
02/03/2011 02:00,st=MA,state_no=2,vote_no=2
02/03/2011 07:00,st=MO,state_no=4,vote_no=1
02/03/2011 08:00,st=MO,state_no=4,vote_no=1

If you run the following search:

* | af classfield=vote_no

You can see that there is a 100% chance (1.0) that my state (state_no) will predict my vote (vote_num), by looking at the accuracy field (acc). You can also see that state is always declared for a vote (cocur = 1).

The use case here is to determine if we can use the data to predict which state will vote for which candidate and with what accuracy we might make a prediction. This is too small a dataset to make accurate predictions, but given a much more representative dataset, I could, with reasonable confidence, predict that a CA or MO voter will pick candidate #1.

HTH
ron

mw
Splunk Employee
Splunk Employee

Thanks Ron. Good stuff! I'm going to post some more of these, so please keep your eyes peeled and chime in if you can.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...