Splunk Search

appending k-means values to results

Builder

I would like to use k-means clustering on a field (k=2) and then discard the search results in the cluster with the smaller mean. kmeans appends the CLUSTERNUM but not the values it converged to. I don't want to do a stats calculation on my result set because I have other commands I need to run, and kmeans has already calculated it anyway. Is it possible to do this?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

You can use eventstats to do this:
| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg
should losslessly filter the results.

I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.

View solution in original post

Splunk Employee
Splunk Employee

You can use eventstats to do this:
| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg
should losslessly filter the results.

I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.

View solution in original post

Builder

Works for me, thanks.

I logged an enhancement request to update kmeans.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!