Splunk Search

correlate uses and samples


Hi All,

Am trying to find the usage of correlation. When i try my search using coorelation, it gives me an output, but am unable to understand the result.

index="citicom" alerts|correlate email, application

result gives as
Rowfield email APPLICATION
email 1.00 1.00
application 1.00 1.00

can anyone explain me the coorelation with some simple example?

Tags (2)
0 Karma


It is inferred from the result of sampling.

NO col1 col2 col3
1 A X Y
2 B

3 C X
4 D

5 E

     col1       col2       col3

col1 100%(5/5) 40%(2/5) 20%(1/5)
col2 40%(2/5) 100%(2/2) 50%(1/2)

col3 20%(1/5) 50%(1/2) 100%(1/1)

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...