What type of "technique" do commands like predict, associate or cluster use?

[rosho]

Hi

In Splunk Enterprise there are some commands (ex: predict, associate, cluster); that already do their work. But in MLTK there are the algorithms that more and less do the same.

My question is:
How do those Splunk's commands work? What type of "technique" do they use to predict, associate or cluster? Is it statistics?

PREDICT = we can do it with algorithms like: ARIMA, Logistic regression, etc

ASSOCIATE = we can do it with algorithms like: Apriori, FP-growth, etc

CLUSTER = DBSCAN, K-means

Thank you

[niketn · Accepted solution]

@rosho please find the details below.

1) predict command uses Kalman's Filter. Refer to documentation.
2) associate command uses Shannon entropy (log base 2). Refer to documentation.
3) cluster command is used to bring similar events together and can be used to identify anomalies. I have not found the details on which algorithm powers it behind the scene, but I have requested Documentation Team couple of times through Splunk Docs feedback.

If you are interested in ARIMA, DBSCAN, KMEANS you can refer to Splunk Machine Learning Toolkit algorithms. Additional contributions for MLTK Algorithms are available on mltk-algo-contrib Git-hub as well.
In fact kmeans is also available as a command in Splunk Enterprise itself.

PS: With latest release of MLTK (4.2 and above) you will also get State Space Algorithm with Smart Forecasting Assistant which allows you to perform fit and apply.