All Apps and Add-ons

When to establish boundaries for MLTK based alerts?

SMM10
Explorer

I was working in the MLTK, very new to it and exploring. I was working to establish a few searches where I will fit a algorithm and then apply it to identify if any values out of a set boundary and then alert on that. I have two question from this.

 

Is this a valid use case or not so much?

I have a predicted value after my fit but, its too close to my actual values so I was thinking of doing something like(+ or - depending on need):

eval bound = (predictedavg - (stdev * 3))

 Would it be more beneficial to calculate this in the fit search or when applying the model?

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...