Knowledge Management

What is the meaning of "probable_cause = eventtype" when using anomalydetection command?

evgiles
New Member

When using the anomalydetection command the probable cause being returned is eventtype? What does this mean? I believe the event type for these events are all the same, yet this is being identified as the reason for the anomaly.

Ed

0 Karma

_jgpm_
Communicator

when I run anomalydetection probable_cause for me is the name of the field that is the outlier.

I'm trying to understand probable_cause_freq, max_freq, and log_Event_prob. The first 2 are [0,1] but the last one is [-21,11] and I can't find detailed documentation on the topic. I've only found \detectinganomalies and the MLTKcheatsheet.

My query is:
|inputcsv test.csv | anomalydetection "STD_A" "STD_B" action=annotate

Thank you!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...