What is the definition of this DensityFunction macro so I can create it or do I need to download this macro?

[POR160893]

Hi,

I am creating a dashboard where I need to use the density function to show anomalies as follows:
| tstats count as total where index=dns by _time span=1h
| fit DensityFunction total dist=norm show_density=true
| bin total bins=100
| stats count avg("ProbabilityDensity(total)") as pd by total

However, when using the ProbabilityDensity function within the machine learning app in Splunk, no results are outputted.

In addition, I see no Probability Density macros "out-of-the-box" within the Machine Learning app either.


What is the definition of this DensityFunction macro so I can create it or do I need to download this macro?

Many thanks,

[tscroggins]

Hi,

Is Splunk Machine Learning Toolkit correctly installed? $SPLUNK_HOME/etc/apps/Splunk_ML_Toolkit/bin/algos/DensityFunction.py should be present.

Are you receiving any errors or warnings after the fit command?