createScoreCombiner

Given a table with multiple scores, assume that a final score was created by combining those scores. Using that final score, create a model that can estimate final scores for other tables (train model).

Example uses for this operator
Assume you have 1 million events with multiple scores and you want to assign final scores for all of them without manually annotating each event. This operator allows you to annotate a subsample of the data (say 100 events) and use that knowledge to score the remaining 99.9%.

This operator creates the model for combining scores. Use the combineScores operator to combine scores using the model that you create with this operator.

Trained models are not displayed in the UI, so remember the name of the model that was created.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter the Create Score Combiner operator in the search field and select the operator from the Results to open the operator form.
3. In the Table drop-down, enter or select the table to create a model.
4. In the Model Name field, enter the name of the model to store it in a particular location.
5. In the Final Score field, enter the column name that contains the final score.
6. Click Run to view the result.
7. Click Save to add the operator to the playbook.
8. Click Cancel to discard the operator form.

Usage Details

LQL Command

createScoreCombiner(table, modelFilename, finalScore, listOfScoreFields)

Input
table: Name of a table that contains finalScore and scoreFields to build a model.
modelFilename: Name of a model filename to store it in a disk. You can use this filename in other playbooks when combining scores (it is trained once and then can be used in multiple predictions).
finalScore: Name of the field that contains final score.
listOfScoreFields: List of field names for scores to combine.

Output
The same table is returned if the model is successfully created.

Example

Input
table = github_logs

LQL command

createScoreCombiner(table, "downloadAndLoginScorer", "finalScore", "downloadScore", "loginScore")

Output

Display that the model has been created.