find reasons for high cpu usage with splunk ML or ?

[nagarjuna559]

I want to find the fields effect cpu usage, when more than 75%. effected fields are memory, ram , running application etc.
I want to find which field (or fields ) effecting cpu performance
if we can find with any algorithm , what is that and how?

[aoliner_splunk]

Hi nagarjuna559,

Most fields will have a comparable effect on performance. One notable exception is categorical fields that have many distinct values, because MLTK will use one-hot encoding to convert those fields into numeric fields. For example, a field that contains US states may have ~50 different values, and that will explode into ~50 fields before the model is fit. You can try running "| stats dc" to see how many distinct values your categorical fields have (ignore the numeric fields).

If that doesn't work, please provide more information about the number of fields you have, what algorithm you're using, etc.