Dashboards & Visualizations

How to create patterns


I am working on a data which contained different types of fields. I wanted to create patterns using these fields.
Ex: the data is as below
process= "processed"

the above data flow is : Processed --> send --> transferred ( if the file is not able to make send/transferred that will reflect on error field )

My question is here, If i search for a file_name this total pattern should be show w.r.t timestamp. How can i create patterns using splunk tool. I am wondering does splunk tool has that much capability to create new patterns and find anomalies from these patterns?

Appreciate for your help


0 Karma


Splunk SPL provides several methods for anomaly detection. Refer to anomalydetection and related commands in Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Also refer to Advanced Statistics documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutadvancedstatistics

In your case you should apply prediction and outlier for all series "processed", "send", "transferred" and "fatal". You can also refer to Splunk Machine Learning Toolkit for this.

| makeresults | eval message= "Happy Splunking!!!"
0 Karma


Thank you for your response.

I have been working on these commands past week but not able to find a proper solution. I can only work on single field but here, if i search a file_name that should be show whole patterns of all fields and if the file_name has missed or low probability then it should show on anomalies list.

NOTE: I want to find out anomalies from the patterns of the file

0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...