topic Anomalydetection in Splunk Search https://community.splunk.com/t5/Splunk-Search/Anomalydetection/m-p/691635#M235491 <P>Hello Splunk team, I was troubleshooting one query with&nbsp;<STRONG><I>anomalydetection</I></STRONG>&nbsp;command (<A href="https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Anomalydetection" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Anomalydetection</A>), and one thing came to my attention. While using&nbsp;<I><SPAN><STRONG><I>action=filter</I></STRONG></SPAN></I>&nbsp;I'm still seeing events<I><SPAN> with&nbsp;<STRONG><I>probable_cause_freq<STRONG><I>=1.0000&nbsp;</I></STRONG></I></STRONG></SPAN></I>and&nbsp;<I><I><I><I><SPAN><STRONG><I>log_event_prob<STRONG><I>=0.000</I></STRONG></I></STRONG></SPAN></I></I></I></I></P><P><SPAN>Should that actually happen? is&nbsp;<STRONG><I>log_event_prob<STRONG><I>=0.000</I></STRONG></I></STRONG>&nbsp;a threshold ? it's not an issue for me to filter it, i just wanted to double check if that is expected behaviour, as i couldn't find it in the documentation.</SPAN></P><P><SPAN>Thanks!</SPAN></P> Wed, 26 Jun 2024 08:51:55 GMT anna11 2024-06-26T08:51:55Z Anomalydetection https://community.splunk.com/t5/Splunk-Search/Anomalydetection/m-p/691635#M235491 <P>Hello Splunk team, I was troubleshooting one query with&nbsp;<STRONG><I>anomalydetection</I></STRONG>&nbsp;command (<A href="https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Anomalydetection" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Anomalydetection</A>), and one thing came to my attention. While using&nbsp;<I><SPAN><STRONG><I>action=filter</I></STRONG></SPAN></I>&nbsp;I'm still seeing events<I><SPAN> with&nbsp;<STRONG><I>probable_cause_freq<STRONG><I>=1.0000&nbsp;</I></STRONG></I></STRONG></SPAN></I>and&nbsp;<I><I><I><I><SPAN><STRONG><I>log_event_prob<STRONG><I>=0.000</I></STRONG></I></STRONG></SPAN></I></I></I></I></P><P><SPAN>Should that actually happen? is&nbsp;<STRONG><I>log_event_prob<STRONG><I>=0.000</I></STRONG></I></STRONG>&nbsp;a threshold ? it's not an issue for me to filter it, i just wanted to double check if that is expected behaviour, as i couldn't find it in the documentation.</SPAN></P><P><SPAN>Thanks!</SPAN></P> Wed, 26 Jun 2024 08:51:55 GMT https://community.splunk.com/t5/Splunk-Search/Anomalydetection/m-p/691635#M235491 anna11 2024-06-26T08:51:55Z