Splunk Search

appending k-means values to results

cphair
Builder

I would like to use k-means clustering on a field (k=2) and then discard the search results in the cluster with the smaller mean. kmeans appends the CLUSTERNUM but not the values it converged to. I don't want to do a stats calculation on my result set because I have other commands I need to run, and kmeans has already calculated it anyway. Is it possible to do this?

Tags (2)
1 Solution

dart
Splunk Employee
Splunk Employee

You can use eventstats to do this:
| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg
should losslessly filter the results.

I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.

View solution in original post

dart
Splunk Employee
Splunk Employee

You can use eventstats to do this:
| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg
should losslessly filter the results.

I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.

cphair
Builder

Works for me, thanks.

I logged an enhancement request to update kmeans.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...