classify

Use classify command to cluster properties of groups identified by the link command. This command returns the following details and the minimum and maximum range of the properties analyzed:

  • Id – Cluster identifier
  • Group Count – Number of groups within a cluster
  • Percentage - Percentage of a cluster relative to the cluster distribution
  • Distance - Distance of a cluster relative to the cluster distribution
  • Anomaly - Whether a cluster is an anomaly relative to the cluster distribution
  • Anomaly Baseline - Baselines used for identifying a cluster as an anomaly

Syntax

* | link <field_name> | classify [<classify_options>] <field_name> [, <field_name>] [as
    <new_field_name>]

Parameters

The following table lists the parameters used in this command, along with their descriptions.

Parameter Description

classify_options

Syntax: [topcount = <count>] [bottomcount = <count>]

where count is the maximum number of clusters to return.

The following command returns an analysis of severity versus count for every transaction:

* | link 'Transaction ID' | classify Severity, Count as 'Severity Analysis'