Knowledge Management

What is the meaning of "probable_cause = eventtype" when using anomalydetection command?

New Member

When using the anomalydetection command the probable cause being returned is eventtype? What does this mean? I believe the event type for these events are all the same, yet this is being identified as the reason for the anomaly.


0 Karma


when I run anomalydetection probable_cause for me is the name of the field that is the outlier.

I'm trying to understand probable_cause_freq, max_freq, and log_Event_prob. The first 2 are [0,1] but the last one is [-21,11] and I can't find detailed documentation on the topic. I've only found \detectinganomalies and the MLTKcheatsheet.

My query is:
|inputcsv test.csv | anomalydetection "STD_A" "STD_B" action=annotate

Thank you!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.