Splunk Enterprise

Unable to select Scoring Field in Behavioral Profiling - Anomaly Scoring Rule

varsha2233
New Member

Hello Splunk Community,

I’m working in the Behavioral Profiling app to create an Anomaly Scoring Rule.
In the Define Indicator Source step, I have successfully selected my Behavioral Indicator (e.g., "Amount Transaction"), but the Scoring Field dropdown is disabled / showing a red mark, and I’m unable to select any value.

Details:

Behavioral Indicator: Amount Transaction

Data is visible when I run the same SPL in Search & Reporting.

Time Range: Last Day (also tried other ranges)

Using the default fields from my dataset (contains account, amount, _time).

The Scoring Field dropdown does not show any options.


What I have tried:

Verified the field exists in my data.

Changed the Time Range to ensure data is available.

Recreated the Behavioral Indicator.


Question:
What specific requirements or field types does the Scoring Field expect?
Do I need to modify the Behavioral Indicator definition or SPL so that this dropdown is populated?

Any guidance or examples would be greatly appreciated.

Thanks in advance!

 

The Data that I have provided for profiling is as follows :

imestamp,account,amount
2025-08-11 11:25:56,ACC1001,2500
2025-08-11 11:25:56,ACC1001,3000
2025-08-11 11:25:56,ACC1001,5000
2025-08-11 11:25:56,ACC1002,1500
2025-08-11 11:25:56,ACC1002,2000
2025-08-11 11:25:56,ACC1003,8000
2025-08-11 11:25:56,ACC1003,4000
2025-08-11 11:25:56,ACC1004,12000
2025-08-11 11:25:56,ACC1005,600
2025-08-11 11:25:56,ACC1005,750
2025-08-11 11:25:56,ACC1006,5000
2025-08-11 11:25:56,ACC1006,7000

 

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...