×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
eduardoduarte
Explorer
Member since: ‎07-24-2019
‎09-10-2021
Community Statistics
Posts 5
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎07-24-2019
Activity Feed
View All

MLTK LogisticRegression probabilities=true only sh...

by in Splunk Search
‎09-08-2021 01:53 AM
‎09-08-2021 01:53 AM
I Have trained a LogisiticRegression model by using TFIDF data (3K events in a month) as input successfully using probabilities=true.  In the fit process it shows the probabilities of everything correctly, I can even do a ROC curve analysis.  The problem comes when use the model by doing a new search and TFIDF the data, and right after the  "|apply logistic_model probabilities=true"  to new data (say... last 24 hours). The behavior is that it only shows the probabilities for the first event (sometimes two or three but not all if I apply the model to "old data") and the others appear blank but the predicted field appears correctly. Now, if I do a search and I apply only the TFIDF_model, without the apply logistic_model and then I "|loadjob  123ABC"  having only the TFIDF data calculated previously and then  Iapply the model to the loaded job of TFIDF data, the probabilities appear magically. I am almost sure this is a bug, but I want to know if there is some workaround ?   Thanks ... View more

Re: How to perform spectrum analysis?

by in Getting Data In
‎08-09-2021 09:37 AM
‎08-09-2021 09:37 AM
A little bit dirty and of course not too fast, but ,  easy to implement as a macro without any library using builtin trigonometry from splunk: | makeresults | eval x="35 21 39 88" | makemv x | mvexpand x | eventstats count as N | streamstats count as n | eval n=n-1 | fields - _time | eventstats values(n) as k | mvexpand k | stats sum(eval(x*cos(2*pi()/N * k * n))) as Fr sum(eval(x*sin(2*pi()/N * k * n) * -1)) as Fi by k ... View more

Re: Taking all pairs of elements in a multivalue f...

by in Splunk Enterprise Security
‎08-07-2019 12:01 AM
‎08-07-2019 12:01 AM
Thank you very much! This was really helpful. ... View more

Re: Taking all pairs of elements in a multivalue f...

by in Splunk Enterprise Security
‎08-06-2019 12:15 AM
‎08-06-2019 12:15 AM
oh, thank you very much. I did modification to your command in order to avoid the hardcoding of MyField2 in the map command. However, I dunno if you can make a two line summary of what you are doing since I do not understnad how do you get all the combinations in different order. | makeresults | eval MyField1="AAA,ZAB,ZAA,RAA" | eval tField=MyField1 | makemv delim="," MyField1 | mvexpand MyField1 | map search=" | makeresults | eval MyField1=\"$MyField1$\" | eval MyField2=\"$tField$\" | makemv delim=\",\" MyField2 | mvexpand MyField2 |table MyField1, MyField2 " | ut_levenshtein(MyField1,MyField2) | table * ... View more

Taking all pairs of elements in a multivalue field...

by in Splunk Enterprise Security
‎07-24-2019 03:59 AM
‎07-24-2019 03:59 AM
Hello. I would like to be able to loop along all the elements of a multivalued field to compare all against each other. There is a macro in the following example that receives two arguments, I would like to check all the possible pairs from the mfield "MyField". Is this possible ? In this example I am just checking the 0th element with the 1st element, but I want to check along all possible pairs in the multivalued field MyField if the outcome of the macro is higher than some value. | makeresults | eval MyField="AAA,ZAB,ZAA,RAA" | makemv delim="," MyField | eval f0=mvindex(MyField,0) | eval f1=mvindex(MyField,1) | `ut_levenshtein(f0,f1)` | table MyField,f0,f1,ut_levenshtein ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-10-2021 02:35 AM
Karma given to
View All