classify
Use classify command to cluster properties of groups identified by the link command. This command returns the following details and the minimum and maximum range of the properties analyzed:
               
- Id – Cluster identifier
 - Group Count – Number of groups within a cluster
 - Percentage - Percentage of a cluster relative to the cluster distribution
 - Distance - Distance of a cluster relative to the cluster distribution
 - Anomaly - Whether a cluster is an anomaly relative to the cluster distribution
 - Anomaly Baseline - Baselines used for identifying a cluster as an anomaly
 
Syntax
* | link <field_name> | classify [<classify_options>] <field_name> [, <field_name>] [as
    <new_field_name>]Parameters
The following table lists the parameters used in this command, along with their descriptions.
| Parameter | Description | 
|---|---|
| 
 
  | 
 Syntax:  where   | 
For examples of using this command in typical scenarios, see:
The following command returns an analysis of severity versus count for every transaction:
* | link 'Transaction ID' | classify Severity, Count as 'Severity Analysis'