All Apps and Add-ons

Exclude select data columns from Splunk algorithms

lancair
Observer

Question : I am trying to determine if it's possible to exclude selected columns of data from algorithm processing when running a search analysis in the search and reporting window. 

This would equate to using a python pandas dataframe and selecting the features you desire from the dataset to be processed or considered in the algorithm.

Example

index=firewall action="allowed" (host="myhost*")
transport="tcp"

-- Assumption: my data has 10 columns, but I only want to use 6 of them in the algorithm.

-- Problem:  Filter the columns to be used when executing the 1CSVM Algorithm. By default I believe Splunk is assuming I want to analyze all columns as features.

`comment("Fit Using 1CSVM Algorithm")`
| fit OneClassSVM * kernel="rbf" gamma=1 nu=.0001 shrinking=False | outputlookup compositeResults.csv append=true

 

Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps the fields command will help.

 

index=firewall action="allowed" (host="myhost*") transport="tcp"
`comment("Exclude the fields we don't want considered by the algorithm")`
| fields - foo bar
`comment("Fit Using 1CSVM Algorithm")`
| fit OneClassSVM * kernel="rbf" gamma=1 nu=.0001 shrinking=False | outputlookup compositeResults.csv append=true

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...