All Apps and Add-ons

Label Encoding in Machine Learning Toolkit

wbw4am
New Member

I believe by default the Machine Learning Toolkit utilizes one hot encoding when converting categorical variables to numerical. Is there an easy way to utilize label encoding? For example - I want to assign a risk score based on country. So China may map to a 5 and US may map to a 1, where 5 is riskier than 1.

I imagine I could do this with a bunch of eval commands in the query or alternatively an additional field extract, but is there a "prettier" way to do this?

0 Karma

aoliner_splunk
Splunk Employee
Splunk Employee

One option, if the scores are relatively static, is to use a lookup. Another option, if you've calculated all the 'risk_score's and want to keep them "up to date" as conditions change, is to use a regression model:

... | fit LinearRegression risk_score from factor_A factor_B ... into my_risk_model

You could use whatever regression algorithm you want and whatever factors you want. Then, when it's time to score:

... | apply my_risk_model
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Have you considered using a lookup?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...