How to create patterns

[chandana204]

Hi,
I am working on a data which contained different types of fields. I wanted to create patterns using these fields.
Ex: the data is as below
process= "processed"
process="send"
transfer="transferred"
error="fatal"

the above data flow is : Processed --> send --> transferred ( if the file is not able to make send/transferred that will reflect on error field )

My question is here, If i search for a file_name this total pattern should be show w.r.t timestamp. How can i create patterns using splunk tool. I am wondering does splunk tool has that much capability to create new patterns and find anomalies from these patterns?

Appreciate for your help

Thanks,
Chandana

[niketn]

Splunk SPL provides several methods for anomaly detection. Refer to anomalydetection and related commands in Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ListOfSearchCommands

Also refer to Advanced Statistics documentation: https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutadvancedstatistics

In your case you should apply prediction and outlier for all series "processed", "send", "transferred" and "fatal". You can also refer to Splunk Machine Learning Toolkit for this.

[chandana204]

Thank you for your response.

I have been working on these commands past week but not able to find a proper solution. I can only work on single field but here, if i search a file_name that should be show whole patterns of all fields and if the file_name has missed or low probability then it should show on anomalies list.

NOTE: I want to find out anomalies from the patterns of the file