relevancy

Description

Calculates how well the event matches the query based on how well the events _raw field matches the keywords of the 'search'. Saves the result into a field named "relevancy". Useful for retrieving the best matching events/documents, rather than the default time-based ordering. Events score a higher relevancy if they have more rare search keywords, more frequently, in fewer terms. For example a search for disk error will favor a short event/document that has 'disk' (a rare term) several times and 'error' once, than a very large event that has 'disk' once and 'error' several times.

Note: The relevancy command does not currently work. See SPL-93039 on the Known issues page here: http://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/KnownIssues

Syntax

relevancy

Examples

Example 1: Calculate the relevancy of the search and sort the results in descending order.

disk error | relevancy | sort -relevancy

See also

abstract, highlight, sort