
cofilter
Description
Use this command to determine how many times field1 and field2 values occur together.
This command implements one step in a collaborative filtering analysis for making recommendations. Given a user field (field1
) and an item field (field2
), it finds how common each pair of items is. That is, it computes sum(A has X and A has Y) where X and Y are distinct items and A is each distinct user.
Syntax
cofilter <field1> <field2>
Required arguments
- field1
- Syntax: <field>
- Description: The name of field.
- field2
- Syntax: <field>
- Description: The name of a field.
Usage
The cofilter
command is a transforming command. See Command types.
Examples
Example 1
Find the cofilter for user
and item
. The user
field must be specified first and followed by the item
field. The output is an event for each pair of items with: the first item and its popularity, the second item and its popularity, and the popularity of that pair of items.
Let's start with a simple search to create a few results:
| makeresults
| eval user="a b c a b c a b c"
| makemv user
| mvexpand user
| streamstats count
The results appear on the Statistics tab and look something like this:
_time | count | user |
---|---|---|
2020-02-19 21:17:54 | 1 | a |
2020-02-19 21:17:54 | 2 | b |
2020-02-19 21:17:54 | 3 | c |
2020-02-19 21:17:54 | 4 | a |
2020-02-19 21:17:54 | 5 | b |
2020-02-19 21:17:54 | 6 | c |
2020-02-19 21:17:54 | 7 | a |
2020-02-19 21:17:54 | 8 | b |
2020-02-19 21:17:54 | 9 | c |
The eval
command with the modulus ( % ) operator is used to create the item
field:
| makeresults
| eval user="a b c a b c a b c"
| makemv user
| mvexpand user
| streamstats count
| eval item = count % 5
The results look something like this:
_time | count | item | user |
---|---|---|---|
2020-02-19 21:17:54 | 1 | 1 | a |
2020-02-19 21:17:54 | 2 | 2 | b |
2020-02-19 21:17:54 | 3 | 3 | c |
2020-02-19 21:17:54 | 4 | 4 | a |
2020-02-19 21:17:54 | 5 | 0 | b |
2020-02-19 21:17:54 | 6 | 1 | c |
2020-02-19 21:17:54 | 7 | 2 | a |
2020-02-19 21:17:54 | 8 | 3 | b |
2020-02-19 21:17:54 | 9 | 4 | c |
Add the cofilter
command to the search to determine for each pair of item
values, how many user
values occurred with each.
| makeresults
| eval user="a b c a b c a b c"
| makemv user
| mvexpand user
| streamstats count
| eval item = count % 5
| cofilter user item
The results look something like this:
Item 1 | Item 1 user count | Item 2 | Item 2 user count | Pair count |
---|---|---|---|---|
1 | 2 | 2 | 2 | 1 |
1 | 2 | 3 | 2 | 1 |
1 | 2 | 4 | 2 | 2 |
2 | 2 | 3 | 2 | 1 |
2 | 2 | 4 | 2 | 1 |
2 | 2 | 0 | 1 | 1 |
3 | 2 | 4 | 2 | 1 |
3 | 2 | 0 | 1 | 1 |
See also
PREVIOUS cluster |
NEXT collect |
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 7.2.4, 7.2.6, 7.2.8, 7.2.7, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012
Feedback submitted, thanks!