Splunk Search

Use Dynamic Float Value with DBSCAN

Deniz_Oe
Explorer

Dear all! 

I am trying to use a dynamic value for my epsilon in the MLTK in Splunk:

 

map search="search index = cisco_prod 
| timechart span=1h count as logins_hour 
| timewrap w series=short| fields - logins_hour_s6|table logins_hour_s*|transpose 0| fit DBSCAN  \"row *\"  eps=$eps$"

 

 This doesn't return anything if eps is a float, only when I first round the dynamic variable.

However if I run the same search with a static float value for eps instead of my variable, it returns the clustering I am looking for.

Has anyone an idea what's wrong with my dynamic search? 

Thanks! 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...