... | jellyfisher algorithm_name(fields_to_read_words_from)
Results will be written into a new field of the name of the chosen algorithm (ex: levensthein_distance)
... | jellyfisher levensthein_distance(sourcetype,source) ... | jellyfisher jaro_distance(user,sourcetype) ... | jellyfisher soundex(sourcetype)
The following search is given as demonstration purpose to load a bunch of words (process names) from a CSV lookup file and then compute their distances using the map() command. This is not the perfect implementation, but a good example to start from :)
| inputlookup processNames.csv | map search="search index=windows | head 10 | stats count by process | eval pName = $processName$ | jellyfisher levenshtein_distance($processName$, process)" | table process, pName, levenshtein_distance
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.