Splunk Search

Use Dynamic Float Value with DBSCAN

Deniz_Oe
Explorer

Dear all! 

I am trying to use a dynamic value for my epsilon in the MLTK in Splunk:

 

map search="search index = cisco_prod 
| timechart span=1h count as logins_hour 
| timewrap w series=short| fields - logins_hour_s6|table logins_hour_s*|transpose 0| fit DBSCAN  \"row *\"  eps=$eps$"

 

 This doesn't return anything if eps is a float, only when I first round the dynamic variable.

However if I run the same search with a static float value for eps instead of my variable, it returns the clustering I am looking for.

Has anyone an idea what's wrong with my dynamic search? 

Thanks! 

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...