Splunk Search

I'd like to get an idea for data grouping.

youngrap
Explorer

I have numeric data.
I'd like to group the data.
It is easy to use 'Kmeans' command, but it cannot be necessarily k=3.
I want to set k automatically.

Or Is there any other good idea to group?

ex)
53,752
53,731
53,699
10,427
10,437
110,854
111,054
111,001
...

result)

53,7521
53,7311
53,6991
10,4272
10,4372
110,8543
111,0543
111,0013
..... 

 

Labels (1)
Tags (3)
0 Karma

DalJeanis
Legend

kmeans has an option for setting a range of ks to attempt.  

 

| kmeans k=3-12

 

Just feed it different data a few times and see what it does for you.  Here's the reference.

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Kmeans

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...