Splunk Dev

How can I use anomalydetection on a subset of fields

dobbysocks
New Member

I am calculating several metrics (such as counts and rates) for the combination of time and usually at least one other dimension, with the intention of using the anomalydetection function to generate alerts on unexpected values. The issue I am running into is that the function sometimes generates an anomaly based on one of the grouping fields instead of on the metrics. When I try to use the fields-list parameter and only provide the metric columns it no longer filters down to the anomalies, instead it returns the entire dataset. It does this even if I explicitly set action=filter. I don't want to remove the grouping columns from the dataset completely because they are helpful for investigating the anomaly. The documentation doesn't include any examples of using the fields-list parameter. I was wondering if anyone has an example of successfully narrowing down to a subset of fields.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...