Splunk Search

appending k-means values to results

cphair
Builder

I would like to use k-means clustering on a field (k=2) and then discard the search results in the cluster with the smaller mean. kmeans appends the CLUSTERNUM but not the values it converged to. I don't want to do a stats calculation on my result set because I have other commands I need to run, and kmeans has already calculated it anyway. Is it possible to do this?

Tags (2)
1 Solution

dart
Splunk Employee
Splunk Employee

You can use eventstats to do this:
| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg
should losslessly filter the results.

I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.

View solution in original post

dart
Splunk Employee
Splunk Employee

You can use eventstats to do this:
| eventstats avg(field) as avg by CLUSTERNUM | eventstats min(avg) as min | where min=avg
should losslessly filter the results.

I'd also suggest filing an enhancement request for kmeans to keep the means, so you can do this more directly.

cphair
Builder

Works for me, thanks.

I logged an enhancement request to update kmeans.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...