I'm trying to use the Smart Outlier Detection use case in MLTK, but after entering the query I don't get the option to move into the "Learn" stage.
Here is my query:
`Internal Macro` earliest=-60m (action="deny" OR action="blocked")
|bin _time span=1m
| stats count as event_count by _time
I think this is the same as a previous time I did the query, which did end up going to the "Learn" stage. It ended up throwing an error stating that dependencies were required the last time. The admin has stated they installed the missing dependencies so it should be working.
Now, it's not even going past the "Define" stage and it's not giving any error messages so either there's something wrong with my query or the app has an issue still.
I'd appreciate any help in this matter.
