Getting Data In

Anomaly Detection on a Key list of fields

koshyk
Super Champion

Our system currently has grown over time with 1000's of enrichments, TA and custom apps. We were planning to upgrade Splunk to another version and wanted to do as much testing automated

So i've developed plan to pump Live data pre & post change in TEST machine thus detecting the important fields, eventtypes, tags are working correctly. But this measurement is done manually

Is there an easy way or module to detect such anomalies or divergence if we give a set of "fields" it should detect for?

For example, what i'm looking for is

 

# set of key-fields
user
eventtypes
tags
host

 

 

I need to detect if the values of these `key-fields` have dramatically changed between two cycles (or dates), thus we can say a particular TA or upgrade caused to break those fields

 

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Machine Learning Toolkit (MLTK) might give you what you need, although you will still have to invest some time developing and evaluating your models before they can reliably be used to detect anomalies.

0 Karma

koshyk
Super Champion

I did check in MLTK thoroughly now, but nothing inbuilt for Splunk own sourcetypes/eventtypes/fields

So it is a generic which I've to build up. hopefully will see if anyone else have built-up on such deviations for Splunk's own fields

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...