Feedback:

kmeans

Use the kmeans operator to perform kmeans clustering on a dataset containing numerical values to determine their cluster groupings based on the number of clusters required.

When using the elbow method, the operator directly displays the number of clusters, distortion, and the number of observations in each cluster.

Note: Depending on your data type, consider using a scaling method such as the StandardScaler operator before using the kmeans operator.

Syntax

|kmeans <field-list> clusters=<clusters> showcentroid=<showcentroid, bool> max_iter=<max_iter>

<field-list>

A comma-separated list of fields to have kmeans clustering applied.
clusters=<clusters>

Specify the number of clusters the dataset is to be grouped into. Can either be an integer or an integer range.

The format for integer range is <val1>-<val2>. For example:

|kmeans field1 clusters=<cluster_number1>-<cluster_number2>

When a range is applied, the output becomes be a table with the distortion and the number of elements in each cluster.
showcentroid=<showcentroid, bool>

Boolean field to determine if the centroid values are to be shown. The default is true. If false, the data points will only be grouped into the clusters without the centroids shown.
max_iter=<max_iter> Maximum number of iterations the kmeans algorithm will be applied. The default is 10000.
tol Convergence tolerance. The default if tol is not specified is 0.001.

Usage

The kmeans operator uses the kmeans machine learning algorithm to partition n observations into k clusters in which each observation belongs to the cluster with the nearest mean. When the clusters argument is specified as a range, this can instead be used to analyze the distortion of the cluster to determine the best number of clusters for the dataset.

Examples

To use kmeans with eventlog:

Example 1: Perform kmeans clustering on multiple fields with default cluster count.

Copy 
|kmeans field1, field2. . . fieldn

Example 2: Perform kmeans clustering with a specific number of clusters.

Copy 
|kmeans field1 . . . fieldn clusters=<cluster_number>

Example 3: Use the elbow method to determine optimal cluster count.

Copy 
|kmeans field1 clusters=<cluster_number1>-<cluster_number2>

To cluster events by product name using the OCSF Schema:

Note: For OCSF schema fields, array indexes start at array[1] and not array[0].

Example 4: Cluster OCSF events by product name using the K-means algorithm.

Copy 
ocsf | aggr count as cnt b