All Apps and Add-ons
Highlighted

using ML Toolkit to detect transaction outliers for more than one customer?

Communicator

I have a working example for the using the predict function in the ML Toolkit to detect out outliers for an overall transaction count or for a single customer but I cannot figure out to use the function for multiple customers. Is that possible or would i need to setup a model for every customer? I need a way to show and alert the NOC if our top 20 customers have transaction count issues and of course static thresholds work poorly. Thanks!

0 Karma
Highlighted

Re: using ML Toolkit to detect transaction outliers for more than one customer?

Esteemed Legend

I would not trust a model built on one data source (customer) for use on another, at least not without a great deal of testing.

0 Karma

Re: using ML Toolkit to detect transaction outliers for more than one customer?

Communicator

can you point to any examples with using the ML app with multiple values in the same dashboard?

0 Karma
Highlighted

Re: using ML Toolkit to detect transaction outliers for more than one customer?

Splunk Employee
Splunk Employee

Are you trying to predict or detect anomalies?

Couple of options :

As of MLTK 2.1, you could use the Detect Numeric Outliers with the "Fields to split by" for your customer fields, and use a sliding window too.

If you take a look at the Conf presentations from last year, https://conf.splunk.com/files/2016/slides/building-a-crystal-ball-forecasting-future-values-for-mult... is pretty awesome.

Are you looking to predict a number of transaction counts and then alert when the residual (actual - predicted/estimated) values differ? you can use the Predict Numeric Fields Assistant with some clever stats by client,dayofweek,hourofday, etc variables. You will have to understand how linear regression works.

0 Karma