All Apps and Add-ons

Obtaining cluster centres details from K-Means algorithm

kiril123
Path Finder

I am using K-Means algorithm from Machine Learning toolkit to cluster some data.
After algorithm has converged i can see two new fields appended to the original data - cluster ID and cluster distance.

This is great, however I also need cluster centre details for each cluster. I need this information to calculate distance to each cluster centre from new data points and then assign these data points to the appropriate cluster.

Is there any way to accomplish this in Splunk?

0 Karma
1 Solution

aoliner_splunk
Splunk Employee
Splunk Employee

You can inspect the KMeans model you built with fit using the summary command:

| summary <your_model_name>

Although, if you're trying to assign new points to the appropriate cluster, you can simply apply your model:

<new_points> | apply <your_model_name>

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

You can also use the cluster distance to calculate centroids of a sort:

| inputlookup iris.csv 
| fit KMeans k=3 petal* 
| eval point_size = 1 
| appendpipe 
    [| stats mean(petal*) as petal* by cluster 
    | eval species = "Centroid: ".cluster
    | eval point_size = 2] 
| fields species  petal* point_size

alt text

aoliner_splunk
Splunk Employee
Splunk Employee

You can inspect the KMeans model you built with fit using the summary command:

| summary <your_model_name>

Although, if you're trying to assign new points to the appropriate cluster, you can simply apply your model:

<new_points> | apply <your_model_name>

kiril123
Path Finder

This is great. Thank you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...