where to start with adaptive thresholding and machine learning


Below is a pic of a kpi put ontop of each other over 4 weeks.
so 1 line, in the graph, is 1 weeks of data at 5minutes resolution.
X, in the graph, is what should have happened - the black line
Y, in the graph, is what did happen - the purple line.

I am exploring way to trigger on this type of behaviour, but I don't really have a clue where to start.

Is there a way I can input my search that produces the below graph, and see how some algorithim or adaptive thresholding would have possible picked this up?

Appreciat any advice in this area.

alt text

Further exploring:


I may need to post a new question but I am thinking of using the outliers chart but it is not showing all the fields as per the serach:

... | fields + _time kpi1_lastWeek lowerBand upperBand isOutlier kpi1_thisWeek *

The idea is that upperBand and lowerBand are derived from kpi1_lastWeek and the Bands create a threshold in which if the kpi1_thisWeek breaches the Bands then there would be an alert/trigger. But I am not sure if I can do this with outliers Chart.
So my question now is how many fields can I have in an outliers chart? And can I have an appendcols in the search because I will have 2 searches, 1 for this week and 1 for last week?
note: There maybe a better way than usingappendcols maybe stats latest(kpi1) earliest(kpi1) (need to check)????

0 Karma

Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...