contingency (alias: ctable)
Use the contingency operator to generate a cross table to find the number of occurrences for the values of two fields.
The contingency operator has an alias— ctable. You can use contingency and ctable operators interchangeably.
Syntax
|contingency <field1> <field2> [maxresults=<int> | addtotals=<bool>]
|ctable <field1> <field2> [maxresults=<int> | addtotals=<bool>]
<field1>
|
Required. Specify the first field to be used in the results table as rows. |
<field2>
|
Required. Specify the second field to be used in the results table as columns. |
maxresults=<int>
|
Optional. Specify an integer value to limit the number of rows returned in the results table. Default: |
addtotals=<bool>
|
Optional. Specify a boolean value to add totals (rows and columns) to the results table. Default: |
Usage
You can use the contingency operator to find the relationship between the values of two fields by finding the number of occurrences (count aggregation) when the values appear.
Examples
Example 1: Create cross-tabulation of source and destination IP addresses.
|contingency src_ip dest_ipExample 2: Generate contingency table without totals and limited results.
|contingency src_ip dest_ip addtotals=false maxresults=100Example 3: Filters OCSF events to those with a non-empty source IP, then builds a contingency table showing how often each product generated traffic from each source IP.
ocsf | where src_endpoint.ip !='' | fields src_endpoint.ip, metadata.product.name |contingency metadata.product.name src_endpoint.ip