https://community.splunk.com/t5/All-Apps-and-Add-ons/When-to-establish-boundaries-for-MLTK-based-alerts/m-p/603610#M77082 <P>I was working in the MLTK, very new to it and exploring. I was working to establish a few searches where I will fit a algorithm and then apply it to identify if any values out of a set boundary and then alert on that. I have two question from this.</P><P>&nbsp;</P><P>Is this a valid use case or not so much?</P><P>I have a predicted value after my fit but, its too close to my actual values so I was thinking of doing something like(+ or - depending on need):</P><LI-CODE lang="markup">eval bound = (predictedavg - (stdev * 3))</LI-CODE><P>&nbsp;Would it be more beneficial to calculate this in the fit search or when applying the model?</P> Tue, 28 Jun 2022 15:05:59 GMT SMM10 2022-06-28T15:05:59Z https://community.splunk.com/t5/All-Apps-and-Add-ons/When-to-establish-boundaries-for-MLTK-based-alerts/m-p/603610#M77082 <P>I was working in the MLTK, very new to it and exploring. I was working to establish a few searches where I will fit a algorithm and then apply it to identify if any values out of a set boundary and then alert on that. I have two question from this.</P><P>&nbsp;</P><P>Is this a valid use case or not so much?</P><P>I have a predicted value after my fit but, its too close to my actual values so I was thinking of doing something like(+ or - depending on need):</P><LI-CODE lang="markup">eval bound = (predictedavg - (stdev * 3))</LI-CODE><P>&nbsp;Would it be more beneficial to calculate this in the fit search or when applying the model?</P> Tue, 28 Jun 2022 15:05:59 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/When-to-establish-boundaries-for-MLTK-based-alerts/m-p/603610#M77082 SMM10 2022-06-28T15:05:59Z