All Apps and Add-ons

Splunk Machine Learning Toolkit: fit/apply Numeric Outlier Detection?

lradics
Path Finder

In using the Machine Learning Toolkit, I've noticed that some assistants (such as Predict Numeric Fields) have an option to save the chosen specifications as a model, and/or train said saved model on a schedule - which, to the best of my knowledge, would then allow the model to grow increasingly intelligent based on the data flowing through it.

Is there an equivalent method for training the Detect Numeric Outliers assistant? So that when it finds outliers for a given time period, it's using data from past trainings in order to determine a suitable average and outlier threshold?

I don't know if it's relevant, but here's the SPL I'm using:

 index=xxx source=xxx reactionTime user=* | sort 0 _time | eval rxnTime=reactionTime/1000 | dedup ID | where rxnTime < 100 | where reactionTime != -1 | eventstats avg("rxnTime") as avg stdev("rxnTime") as stdev  | eval lowerBound=(avg-stdev*exact(1.2)), upperBound=(avg+stdev*exact(5)) | eval isOutlier=if('rxnTime' < lowerBound OR 'rxnTime' > upperBound, 1, 0) | search isOutlier=1 | table _time, "rxnTime", lowerBound, upperBound, isOutlier, avg, user

Thank you!

0 Karma
1 Solution

cmerriman
Super Champion

the way to save a model and keep using it is to fit it into a saved model and apply it. to do that, you need to use an algorithm from the scikit you can get here: http://scikit-learn.org/stable/auto_examples/index.html

the algorithm for numerical/categorical outliers is OneClassSVM.
https://docs.splunk.com/Documentation/MLApp/2.2.0/User/Algorithms#Anomaly_Detectors

View solution in original post

0 Karma

cmerriman
Super Champion

the way to save a model and keep using it is to fit it into a saved model and apply it. to do that, you need to use an algorithm from the scikit you can get here: http://scikit-learn.org/stable/auto_examples/index.html

the algorithm for numerical/categorical outliers is OneClassSVM.
https://docs.splunk.com/Documentation/MLApp/2.2.0/User/Algorithms#Anomaly_Detectors

0 Karma

lradics
Path Finder

Thank you - that's exactly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...