Splunk Search

I'd like to get an idea for data grouping.

youngrap
Explorer

I have numeric data.
I'd like to group the data.
It is easy to use 'Kmeans' command, but it cannot be necessarily k=3.
I want to set k automatically.

Or Is there any other good idea to group?

ex)
53,752
53,731
53,699
10,427
10,437
110,854
111,054
111,001
...

result)

53,7521
53,7311
53,6991
10,4272
10,4372
110,8543
111,0543
111,0013
..... 

 

Labels (1)
Tags (3)
0 Karma

DalJeanis
Legend

kmeans has an option for setting a range of ks to attempt.  

 

| kmeans k=3-12

 

Just feed it different data a few times and see what it does for you.  Here's the reference.

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Kmeans

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...