Splunk Search

I'd like to get an idea for data grouping.

youngrap
Explorer

I have numeric data.
I'd like to group the data.
It is easy to use 'Kmeans' command, but it cannot be necessarily k=3.
I want to set k automatically.

Or Is there any other good idea to group?

ex)
53,752
53,731
53,699
10,427
10,437
110,854
111,054
111,001
...

result)

53,7521
53,7311
53,6991
10,4272
10,4372
110,8543
111,0543
111,0013
..... 

 

Labels (1)
Tags (3)
0 Karma

DalJeanis
Legend

kmeans has an option for setting a range of ks to attempt.  

 

| kmeans k=3-12

 

Just feed it different data a few times and see what it does for you.  Here's the reference.

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Kmeans

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...