topic Re: Anomaly Detection Feature in Service for ITSI? in Splunk ITSI

Anomaly Detection Feature in Service for ITSI?

satyab — Sun, 07 Jun 2020 00:40:53 GMT

Hello ALL,
I would like to know is where are anomaly detection Information is stored in ITSI?, I mean any specific Index bucket? or is that a Black Box for us?.I know it is going into "Episode review" but that will not help me . I need to pro grammatically get this information just like I get KPI score from ITSI-Summary. As I need to stop my system alerting when it detects Anomaly.

Secondly, where can I find detailed information about how it is detecting Anomaly?As, I was wondering is there an option to change any setting?

Thanks
Satya

Re: Anomaly Detection Feature in Service for ITSI?

esnyder_splunk — Thu, 30 Jan 2020 18:54:00 GMT

Hi Satya, this documentation might help to answer your second question: https://docs.splunk.com/Documentation/ITSI/latest/Configure/Enableanomalydetection

Re: Anomaly Detection Feature in Service for ITSI?

skoelpin — Thu, 30 Jan 2020 19:25:33 GMT

Are you using cohesive AD or trending AD? This is stored in the kv-store. You can configure this in the mad.conf settings within the SA-ITSI-MetricAD app.

What exactly are you looking for?

Re: Anomaly Detection Feature in Service for ITSI?

satyab — Tue, 04 Feb 2020 09:19:32 GMT

Thanks for your time.

Im using Trending AD. what I need is . If you use the feature it shows RED points on graph to indicate its a anomaly. How can I get complete information using Splunk Query ? I cant manually get to any file to review the information.

for example I have a KPI and I want to know whats its Health score. then I can use index=ITSI_Summary and kpi name to get the score value . by running a query, I need similar setup.

Like I said I need to avoid certain steps in a process when model detects anomaly.

Thanks Satya

Re: Anomaly Detection Feature in Service for ITSI?

satyab — Tue, 04 Feb 2020 09:20:42 GMT

Thanks this is general setup document. thats it what I am looking for.

Re: Anomaly Detection Feature in Service for ITSI?

skoelpin — Tue, 04 Feb 2020 17:58:03 GMT

This is a limitation of the product. As far as I know, it does NOT write the anomalous behavior to the itsi_summary index. I've been a big advocate for doing adaptive thresholding on a per entity basis which WOULD write to the itsi summary index as it does with the aggregate values. I've also built my own in-house solution of this which works on thousands of entities per KPI. It's much faster than the current AT with a lighter footprint. So my suggestion is to wait for it to become available and keep asking the product team for it

Re: Anomaly Detection Feature in Service for ITSI?

esnyder_splunk — Thu, 06 Feb 2020 00:12:18 GMT

Configuration:
- KPI object in the service object
- A collection in SA-ITSI-MetricAD
- Savedsearches.conf in SA-ITSI-MetricAD

Computational Middle Work:
- there is an index for it called anomaly or something defined in SA-ITSI-MetricAD

Final resultant Anomaly:
- it's a notable event like any other, so tracked alerts index and then the episodes index

Re: Anomaly Detection Feature in Service for ITSI?

satyab — Thu, 06 Feb 2020 09:37:45 GMT

Thanks you. Sure will do.