Splunk Search

I'd like to get an idea for data grouping.

youngrap
Explorer

I have numeric data.
I'd like to group the data.
It is easy to use 'Kmeans' command, but it cannot be necessarily k=3.
I want to set k automatically.

Or Is there any other good idea to group?

ex)
53,752
53,731
53,699
10,427
10,437
110,854
111,054
111,001
...

result)

53,7521
53,7311
53,6991
10,4272
10,4372
110,8543
111,0543
111,0013
..... 

 

Tags (3)
0 Karma

DalJeanis
Legend

kmeans has an option for setting a range of ks to attempt.  

 

| kmeans k=3-12

 

Just feed it different data a few times and see what it does for you.  Here's the reference.

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Kmeans

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...