Splunk Search
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

AnomaliDetection does not detect outlier data

ashishmgupta
Explorer
‎10-29-2020 02:39 PM

In the below dataset, there are two different ISPs for the user from their usual ones.
NordVPN for John and Quadranet for Jill – but this search using anomalidetection is detecting only john’s but not Jill’s.
Any idea why and what is the better way to detect the ISP outlier?

source="isp_data2.csv"  index="test" sourcetype="csv"
| anomalydetection "ISP" "EmailAddress" action=annotate
| eval isOutlier = if(probable_cause != "", "1", "0")
| table "ISP" "EmailAddress", probable_cause, isOutlier
| sort 100000 probable_cause

 

 

EmailAddressISPtimestamp
john@example.comComcast1/1/2020
john@example.comComcast1/2/2020
john@example.comComcast1/3/2020
john@example.comComcast1/4/2020
john@example.comComcast1/5/2020
john@example.comComcast1/6/2020
john@example.comComcast1/7/2020
john@example.comComcast1/8/2020
john@example.comComcast1/9/2020
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comNordVPN########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
john@example.comComcast########
jill@example.comSpectrum2/1/2020
jill@example.comSpectrum2/2/2020
jill@example.comSpectrum2/3/2020
jill@example.comSpectrum2/4/2020
jill@example.comSpectrum2/5/2020
jill@example.comSpectrum2/6/2020
jill@example.comSpectrum2/7/2020
jill@example.comSpectrum2/8/2020
jill@example.comSpectrum2/9/2020
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comQuadranet########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum########
jill@example.comSpectrum3/1/2020
Labels (1)
Labels
0 Karma
Reply
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...