Calculates how well the event matches the query based on how well the events _raw field matches the keywords of the 'search'. Saves the result into a field named "relevancy". Useful for retrieving the best matching events/documents, rather than the default time-based ordering. Events score a higher relevancy if they have more rare search keywords, more frequently, in fewer terms. For example a search for disk error will favor a short event/document that has 'disk' (a rare term) several times and 'error' once, than a very large event that has 'disk' once and 'error' several times.
Note: The relevancy command does not currently work. See SPL-93039 on the Known issues page here: http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/KnownIssues
Example 1: Calculate the relevancy of the search and sort the results in descending order.
disk error | relevancy | sort -relevancy
This documentation applies to the following versions of Splunk Cloud™: 7.0.11, 7.0.13, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 8.0.2001, 8.0.2003, 8.0.2004, 8.0.2006, 8.0.2007, 8.1.2008