relevancy
relevancy
Synopsis
Calculates how well the event matches the query.
Syntax
relevancy
Description
Calculates the 'relevancy' field based on how well the events _raw field matches the keywords of the 'search'. Useful for retrieving the best matching events/documents, rather than the default time-based ordering. Events score a higher relevancy if they have more rare search keywords, more frequently, in fewer terms. For example a search for disk error will favor a short event/document that has 'disk' (a rare term) several times and 'error' once, than a very large event that has 'disk' once and 'error' several times.
Examples
Example 1: Calculate the relevancy of the search and sort the results in descending order.
disk error | relevancy | sort -relevancySee also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the relevancy command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 View the Article History for its revisions.