Splunk Search

I'd like to get an idea for data grouping.

youngrap
Explorer

I have numeric data.
I'd like to group the data.
It is easy to use 'Kmeans' command, but it cannot be necessarily k=3.
I want to set k automatically.

Or Is there any other good idea to group?

ex)
53,752
53,731
53,699
10,427
10,437
110,854
111,054
111,001
...

result)

53,7521
53,7311
53,6991
10,4272
10,4372
110,8543
111,0543
111,0013
..... 

 

Tags (3)
0 Karma

DalJeanis
Legend

kmeans has an option for setting a range of ks to attempt.  

 

| kmeans k=3-12

 

Just feed it different data a few times and see what it does for you.  Here's the reference.

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Kmeans

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...