Related Answers
Download topic as PDF
cofilter
Description
Use this command to determine how many times field1 and field2 values occur together.
This command implements one step in a collaborative filtering analysis for making recommendations. Given a user field (field1) and an item field (field2), it finds how common each pair of items is. That is, it computes sum(A has X and A has Y) where X and Y are distinct items and A is each distinct user.
Syntax
cofilter <field1> <field2>
Required arguments
- field1
- Syntax: <field>
- Description: The name of field.
- field2
- Syntax: <field>
- Description: The name of a field.
Usage
The cofilter command is a transforming command. See Command types.
Examples
Example 1:
Find the cofilter for user and item. The user field must be specified first and followed by the item field. The output is event for each pair of items with: the first item and its popularity, the second item and its popularity, and the popularity of that pair of items.
... | cofilter user item
See also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has about using the cofilter command.
|
PREVIOUS cluster |
NEXT collect |
This documentation applies to the following versions of Splunk Cloud™: 7.0.8, 7.0.11, 7.0.13, 7.1.3, 7.1.6, 7.2.3, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 8.0.0, 8.0.1, 8.0.2001
Comments
Based on the docs for both commands, I believe that `contingency` should be in the `see also` section. I am not sure because I cannot get `cofilter` to work in some test. Perhaps the `cofilter` command doesn't work or is deprecated?
I stand by my earlier unaddressed comment. Others are confused, too:
https://answers.splunk.com/answers/593836/are-counts-form-the-cofilter-command-symmetric.html
Try this run-anywhere; it does NOTHING:
| makeresults
| eval user="a b c a b c a b c a b c a b c a b c a b c a b c"
| makemv user
| mvexpand user
| streamstats count AS item
| eval item = item % 5
| multireport
[ cofilter user item
| eval DATASET="cofilter" ]
[ stats dc(item) BY user
| eval DATASET="itemBYuser" ]
[ stats dc(user) BY item
| eval DATASET="userBYitem" ]