Can someone explain me the meaning of cluster in splunk

[aditsss]

Hi Everyone,

Can some one explain me what is the meaning of these two functions:

cluster showcount=t t=0.3

cluster showcount=t t=0.9

Thanks in advance

[isoutamo · Accepted solution]

Hi

with this command you could analyse events which you have in splunk and found those which are enough similar. Parameter t defines how similar those must be to taken into same cluster.

More:

• https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Cluster
• https://en.wikipedia.org/wiki/Cluster_analysis
• https://www.statisticssolutions.com/directory-of-statistical-analyses-cluster-analysis/

r. Ismo