topic Re: For Anomaly detection, on string field, which method is better - Zscore or histogram? in Splunk Search

For Anomaly detection, on string field, which method is better - Zscore or histogram?

VS0909 — Wed, 02 Sep 2020 06:31:23 GMT

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest

Re: For Anomaly detection, on string field, which method is better - Zscore or histogram?

thambisetty — Wed, 02 Sep 2020 06:35:24 GMT

https://conf.splunk.com/files/2019/recordings/FN1390.mp4

Re: For Anomaly detection, on string field, which method is better - Zscore or histogram?

VS0909 — Wed, 02 Sep 2020 06:42:31 GMT

@thambisettyThanks for the reply!

This mentions mostly for numeric fields, I am looking for Zscore or histogram for string(character) field.

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest!

Re: For Anomaly detection, on string field, which method is better - Zscore or histogram?

thambisetty — Wed, 02 Sep 2020 06:51:03 GMT

z--score, you should apply standard deviation to see how the values are deviating. with out count of strings, I don't know how you calculate zscore, or histogram.