topic Re: How to create patterns in Dashboards & Visualizations

How to create patterns

chandana204 — Fri, 26 Jan 2018 17:58:22 GMT

Hi,
I am working on a data which contained different types of fields. I wanted to create patterns using these fields.
Ex: the data is as below
process= "processed"
process="send"
transfer="transferred"
error="fatal"

the above data flow is : Processed --> send --> transferred ( if the file is not able to make send/transferred that will reflect on error field )

My question is here, If i search for a file_name this total pattern should be show w.r.t timestamp. How can i create patterns using splunk tool. I am wondering does splunk tool has that much capability to create new patterns and find anomalies from these patterns?

Appreciate for your help

Thanks,
Chandana

Re: How to create patterns

niketn — Fri, 26 Jan 2018 18:12:52 GMT

Splunk SPL provides several methods for anomaly detection. Refer to anomalydetection and related commands in Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Also refer to Advanced Statistics documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutadvancedstatistics

In your case you should apply prediction and outlier for all series "processed", "send", "transferred" and "fatal". You can also refer to Splunk Machine Learning Toolkit for this.

Re: How to create patterns

chandana204 — Tue, 29 Sep 2020 17:51:28 GMT

Thank you for your response.

I have been working on these commands past week but not able to find a proper solution. I can only work on single field but here, if i search a file_name that should be show whole patterns of all fields and if the file_name has missed or low probability then it should show on anomalies list.

NOTE: I want to find out anomalies from the patterns of the file