Label Encoding in Machine Learning Toolkit

[wbw4am]

I believe by default the Machine Learning Toolkit utilizes one hot encoding when converting categorical variables to numerical. Is there an easy way to utilize label encoding? For example - I want to assign a risk score based on country. So China may map to a 5 and US may map to a 1, where 5 is riskier than 1.

I imagine I could do this with a bunch of eval commands in the query or alternatively an additional field extract, but is there a "prettier" way to do this?

[aoliner_splunk]

One option, if the scores are relatively static, is to use a lookup. Another option, if you've calculated all the 'risk_score's and want to keep them "up to date" as conditions change, is to use a regression model:

... | fit LinearRegression risk_score from factor_A factor_B ... into my_risk_model

You could use whatever regression algorithm you want and whatever factors you want. Then, when it's time to score:

... | apply my_risk_model

[aljohnson_splun]

Have you considered using a lookup?