https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106847#M27800 <P>anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.</P> Mon, 02 Apr 2012 23:06:34 GMT steveyz 2012-04-02T23:06:34Z https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106846#M27799 <P>Hi,</P> <P>Can anyone explain the difference between anomalies and anomalousvalue? From the search reference, it looks like anomalies operates on a single field and is context-sensitive (i.e. looks at the surrounding X events to see if the current event is unusual), while anomalousvalue looks at the combination of all fields over the entire time range. If that's wrong, please correct me.</P> Mon, 02 Apr 2012 15:23:32 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106846#M27799 cphair 2012-04-02T15:23:32Z https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106847#M27800 <P>anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.</P> Mon, 02 Apr 2012 23:06:34 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106847#M27800 steveyz 2012-04-02T23:06:34Z https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106848#M27801 <P>So if had data that had host and event fields, and I ran anomalousvalue action=filter host,event ... would I get a set of results that listed the unusual hosts, or the unusual events, or the rarest host/event combinations? For that matter, what's the difference between anomalous and rare?</P> <P>Am I correct that anomalies looks at the immediate surrounding events and anomalousvalue looks at everything in the range?</P> Tue, 03 Apr 2012 13:57:33 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106848#M27801 cphair 2012-04-03T13:57:33Z https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106849#M27802 <P>@steveyz -- not sure if you got a notification about my previous comment...</P> Thu, 05 Apr 2012 13:30:03 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106849#M27802 cphair 2012-04-05T13:30:03Z https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106850#M27803 <P>You would get a list of results that had either unusual hosts, unusual events, or both.</P> <P>Rare is just the converse of top and is purely a reporting command. Rare doesn't necessarily mean anomalous if you you have a lot of rare values. anomalousvalue considers the distribution of values when deciding if something is anomalous or not. Also for numerical fields, anomalousvalue uses average and variance/stdev to determine what is anomalous.</P> <P>Anomalousvalue does look at the whole event set. I'm actually not that familar with 'anomalies' so i'm not sure exactly what does not.</P> Thu, 05 Apr 2012 18:02:12 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106850#M27803 steveyz 2012-04-05T18:02:12Z https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106851#M27804 <P>Perhaps someone might find this useful:</P> <P><A href="http://www.prelert.com/blog/anomaly-detective-vs-splunks-anomalies-command-what-is-the-difference/">http://www.prelert.com/blog/anomaly-detective-vs-splunks-anomalies-command-what-is-the-difference/</A></P> Wed, 12 Feb 2014 14:13:36 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-anomalies-and-anomalousvalue/m-p/106851#M27804 richcollier 2014-02-12T14:13:36Z