Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results forย

All Apps and Add-ons

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results forย

- Community
- :
- Splunk Answers
- :
- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- How Anomaly and Anomalydetection commands works in...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

chandana204

Path Finder

โ01-22-2018
01:25 PM

Hi,

I have started to learning machine learning concepts and trying to imply on Splunk tool. So, i tried to use anomaly and anomalydetection search commands but i couldn't understand how these commands are working. I have gone through documentation, there i can find how to use commands but i want to know how it's working in background. Can anyone please explain in detail.

Appreciate your time

Thanks,

Chandana

1 Solution

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

aoliner_splunk

Splunk Employee

โ01-23-2018
09:06 AM

Hi Chandana,

Could you please say more about what's missing in the documentation? For example, the anomalydetection command docs say that it "identifies anomalous events by computing a probability for each event and then detecting unusually small probabilities. The probability is defined as the product of the frequencies of each individual field value in the event." It then goes on to explain how those field value probabilities are computed. So, if you have two fields, A="blue" and B=7, where A has the value "blue" 25% of the time and B has a histogram of values such that the bin containing 7 is 10% of the mass of the histogram, then the probability of the event would be p = 0.25 * 0.1 = 0.025.

Does that make sense? Is it not behaving as expected?

Cheers,

- Adam

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

jcvytla

New Member

โ03-28-2018
10:55 AM

Hi @chandana204

I'm also working on similar problem. could you please guide me through solution..

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

aoliner_splunk

Splunk Employee

โ01-23-2018
09:06 AM

Hi Chandana,

Could you please say more about what's missing in the documentation? For example, the anomalydetection command docs say that it "identifies anomalous events by computing a probability for each event and then detecting unusually small probabilities. The probability is defined as the product of the frequencies of each individual field value in the event." It then goes on to explain how those field value probabilities are computed. So, if you have two fields, A="blue" and B=7, where A has the value "blue" 25% of the time and B has a histogram of values such that the bin containing 7 is 10% of the mass of the histogram, then the probability of the event would be p = 0.25 * 0.1 = 0.025.

Does that make sense? Is it not behaving as expected?

Cheers,

- Adam

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

buraka

New Member

โ03-29-2018
02:20 AM

How are the histogram intervals decided, is it hard coded to 10%, can we change accordingly?

And is there a threshold value where we can control/change by probability value?

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

aoliner_splunk

Splunk Employee

โ04-06-2018
03:52 PM

Hi buraka,

There are three modes. The histogram mode is controlled by the pthresh option. For the other two modes, the docs say, "When method=zscore, performs like the anomalousvalue command. When method=iqr, performs like the outlier command." Please see the corresponding docs for those commands.

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

skoelpin

SplunkTrust

โ03-28-2018
11:22 AM

Good explanation..

Perhaps you could give us your use case @chandana204