Splunk Dev

How can I use anomalydetection on a subset of fields

dobbysocks
New Member

I am calculating several metrics (such as counts and rates) for the combination of time and usually at least one other dimension, with the intention of using the anomalydetection function to generate alerts on unexpected values. The issue I am running into is that the function sometimes generates an anomaly based on one of the grouping fields instead of on the metrics. When I try to use the fields-list parameter and only provide the metric columns it no longer filters down to the anomalies, instead it returns the entire dataset. It does this even if I explicitly set action=filter. I don't want to remove the grouping columns from the dataset completely because they are helpful for investigating the anomaly. The documentation doesn't include any examples of using the fields-list parameter. I was wondering if anyone has an example of successfully narrowing down to a subset of fields.

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...