contingency
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
contingency
Synopsis
Builds a contingency table for two fields.
Syntax
contingency [contingency-option]* field field
Arguments
- contingency-option
- Syntax:
- Description:
Description
In statistics, contingency tables are used to record and analyze the relationship between two or more (usually categorical) variables. Many metrics of association or independence can be calculated based on contingency tables, such as the phi coefficient or the V of Cramer.
Examples
Example 1: Build a contingency table of "datafields" from all events.
... | contingency datafield1 datafield2 maxrows=5 maxcols=5 usetotal=F
Example 2: Build a contingency table for fields "host" and "sourcetype".
... | contingency host sourcetype