Edit distance: Levenshtein (levenshtein)
Description
Creates a new column that returns the Levenshtein edit distance between two strings.
How does it work in the search window?
Select Create field in the search window toolbar, then select the Edit distance: Levenshtein operation. You need to specify two arguments:
Argument | Data type |
---|---|
String mandatory | string |
String mandatory | string |
The data type of the values in the new field is integer.
Example
In the siem.logtrust.web.activity
table, we want to know the Levenshtein distance between the strings in the sessionid and correlationId field. To do it, we will create a new column using the Edit distance: Levenshtein operation.
The arguments needed to create the new column are:
String - sessionid field
String - correlationId field
Click Create field and you will see the following result:
How does it work in LINQ?
Use the operator select
... as
... and add the operation syntax to create the new column. This is the syntax for the Edit distance: Levenshtein operation:
levenshtein(string1, string2)
Example
You can copy the following LINQ script and try the above example on the demo.ecommerce.data
table:
from demo.ecommerce.data
select levenshtein(referralUri, uri) as levenshtein