Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

AnomaliDetection does not detect outlier data

ashishmgupta
Explorer
‎10-29-2020 02:39 PM

In the below dataset, there are two different ISPs for the user from their usual ones.
NordVPN for John and Quadranet for Jill – but this search using anomalidetection is detecting only john’s but not Jill’s.
Any idea why and what is the better way to detect the ISP outlier?

source="isp_data2.csv"  index="test" sourcetype="csv"
| anomalydetection "ISP" "EmailAddress" action=annotate
| eval isOutlier = if(probable_cause != "", "1", "0")
| table "ISP" "EmailAddress", probable_cause, isOutlier
| sort 100000 probable_cause

 

 

EmailAddressISPtimestamp
john@example.comComcast1/1/2020
john@example.comComcast1/2/2020
john@example.comComcast1/3/2020
john@example.comComcast1/4/2020
john@example.comComcast1/5/2020
john@example.comComcast1/6/2020
john@example.comComcast1/7/2020
john@example.comComcast1/8/2020
john@example.comComcast1/9/2020
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comNordVPN########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
jill@example.comSpectrum2/1/2020
jill@example.comSpectrum2/2/2020
jill@example.comSpectrum2/3/2020
jill@example.comSpectrum2/4/2020
jill@example.comSpectrum2/5/2020
jill@example.comSpectrum2/6/2020
jill@example.comSpectrum2/7/2020
jill@example.comSpectrum2/8/2020
jill@example.comSpectrum2/9/2020
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comQuadranet########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum3/1/2020
0 Karma
Reply
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...