The associate command is most useful to analyze events related to system resource utilization. It can be leveraged to understand if there is any relationship between the type of DB action being executed by the web application and the current memory utilization. The following search will group events together into transactions based on their given threadId, and then compile relationships between the dbAction and mem_user fields using the associate command:
index=main sourcetype=log4j | transaction threadId | associate supcnt=50 dbAction mem_used
This can be most beneficial when trying to understand how function calls have an impact on resource utilization by drawing out direct relationships ...
