I am working with the Splunk Machine Learning (ML) toolkit to detect anomalies in product logs. Particularly, I have logs in Splunk that contain usernames and cities the user has logged in from. Is there any way I can use ML, or any other methods in Splunk, to detect anomalous login locations for a particular user by analyzing the history of that user's logins?
The logs I have contain hundreds of different users, so this alert would need to map each user with their login locations and detect any anomalous cities from their history of locations. If anyone has any ideas, tips, or guidance, I will be very grateful!