Splunk Machine Learning Toolkit: Density Function

[Nick102]

Hi, I'm trying to use the density function to detect anomalous logins compared to normal user usage.
I use the fit command like this

Nick102_0-1764605724215.png

and the apply command like this

Nick102_1-1764605752894.png

The result is the following

Nick102_2-1764605917765.png

I can't figure out why the log_likelihood anomaly_score columns aren't populated.

thank you for your help

[tscroggins]

Hi @Nick102,

The DensityFunction algorithm has output fields IsOutlier(field), which can be renamed as part of the apply command, and BoundaryRanges.

Are you working from a specific example or reading documentation where a log_likelihood field is referenced?