Feedback:

fit StandardScaler

Use the StandardScaler algorithm to standardize data fields to attain zero mean and unit standard deviation, using the scikit-learn standard scaler algorithm.

The StandardScaler operator retains all original columns, including those used for grouping and context. This enhancement ensures that contextual columns like src_user and time_bucket_format are included in the result set, allowing users to continue analysis seamlessly, with full access to both the scaled features and their associated context.

Syntax

fit standardscaler [option_name]=[value] <fields> [into '<model_name>']

[option_name]=[value]

Specify model parameters:

  • with_mean={true|false}

  • with_std={true|false}

For information on the model parameters, refer to scikit learn documentation:

https://scikit-learn.org/stable/modules/generated/sklearn.preprocessing.StandardScaler.html

<fields> Input fields for scaling.
into Specify the into keyword to store the learned model in an artifact that can later be applied to new search results with the apply operator.
'<model_name>'

Specify the name of the model to save as an artifact, so that it can be used with the apply operator. The model name must be wrapped with single or double straight quotation marks.

Usage

Use StandardScaler before applying machine learning algorithms that are sensitive to feature scales, especially those that use Euclidean distances. StandardScaler transforms features to have a mean of zero and standard deviation of one, ensuring all features contribute equally to the model's learning process.

Examples

Example 1:

Copy 
|fit standardscaler petal_length petal_width sepal_length sepal_width species

Example 2:

Copy 
|fit standardscaler with_mean=true with_std=true petal_length petal_width sepal_length sepal_width species

Example 3:

Copy 
|fit standardscaler with_mean=true with_std=true petal_length petal_width sepal_length sepal_width species into 'iris_std_scaler'

Example 4:

Copy 
| bin span=20m event_time as time_bucket
| calc time_bucket_format= strftime(time_bucket, "%Y-%m-%d %H:%M")
| aggr count() as logon_count, count_distinct(src_ip) as dist_ip by user, time_bucket_format
| fit standardscaler logon_count dist_ip