https://community.splunk.com/t5/Splunk-Search/appending-k-means-values-to-results/m-p/80356#M20308 <P>You can use <CODE>eventstats</CODE> to do this:<BR /> <CODE>| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg</CODE><BR /> should losslessly filter the results.</P> <P>I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.</P> Mon, 08 Oct 2012 14:41:57 GMT dart 2012-10-08T14:41:57Z https://community.splunk.com/t5/Splunk-Search/appending-k-means-values-to-results/m-p/80355#M20307 <P>I would like to use k-means clustering on a field (k=2) and then discard the search results in the cluster with the smaller mean. kmeans appends the CLUSTERNUM but not the values it converged to. I don't want to do a stats calculation on my result set because I have other commands I need to run, and kmeans has already calculated it anyway. Is it possible to do this?</P> Thu, 04 Oct 2012 16:57:36 GMT https://community.splunk.com/t5/Splunk-Search/appending-k-means-values-to-results/m-p/80355#M20307 cphair 2012-10-04T16:57:36Z https://community.splunk.com/t5/Splunk-Search/appending-k-means-values-to-results/m-p/80356#M20308 <P>You can use <CODE>eventstats</CODE> to do this:<BR /> <CODE>| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg</CODE><BR /> should losslessly filter the results.</P> <P>I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.</P> Mon, 08 Oct 2012 14:41:57 GMT https://community.splunk.com/t5/Splunk-Search/appending-k-means-values-to-results/m-p/80356#M20308 dart 2012-10-08T14:41:57Z https://community.splunk.com/t5/Splunk-Search/appending-k-means-values-to-results/m-p/80357#M20309 <P>Works for me, thanks.</P> <P>I logged an enhancement request to update kmeans.</P> Mon, 08 Oct 2012 17:53:20 GMT https://community.splunk.com/t5/Splunk-Search/appending-k-means-values-to-results/m-p/80357#M20309 cphair 2012-10-08T17:53:20Z