arules
Description
The arules command looks for associative relationships between field values. The command returns a table with the following columns: Given fields, Implied fields, Strength, Given fields support, and Implied fields support. The given and implied field values are the values of the fields you supply. The Strength value indicates the relationship between (among) the given and implied field values.
Implements the arules algorithm as discussed in Michael Hahsler, Bettina Gruen and Kurt Hornik (2012). arules: Mining Association Rules and Frequent Itemsets. R package version 1.0-12. This algorithm is similar to the algorithms used for online shopping websites which suggest related items based on what items other customers have viewed or purchased.
Syntax
arules [<arules-option>... ] <field-list>...
Required arguments
- field-list
- Syntax: <field> <field> ...
- Description: The list of field names. At least two fields must be specified.
Optional arguments
- <arules-option>
- Syntax: <support> | <confidence>
- Description: Options for arules command.
arules options
- support
- Syntax: sup=<int>
- Description: Specify a support limit. Associations with computed support levels smaller than this value are not included in the output results. The support option must be a positive integer.
- Default: 3
- confidence
- Syntax: conf=<float>
- Description: Specify a confidence limit. Associations with a confidence (expressed as
Strength
field) are not included in the output results. Must be between 0 and 1. - Default: .5
Usage
The arules
command is a streaming command that is both distributable streaming and centralized streaming. See Command types.
Examples
Example 1: Search for the likelihood that the fields are related.
... | arules field1 field2 field3
Example 2:
... | arules sup=3 conf=.6 field1 field2 field3
See also
appendpipe | associate |
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release)
Feedback submitted, thanks!