Anomalies Command

[daniel333]

All,

Just started looking at Anomalies command. Re-read the doc a few times and played with the command some but I don't get it's usefulness. Can you give me some examples of how you're using this command? What kind of problems I might solve?

http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Anomalies

[jkat54]

Let's say your mail server typically sends 5000 emails per day... But today the count goes to 50000. Anomalies would help you find that but more importantly... Running a search daily that looks for anomalies would alert you to the condition possibly sooner than you would see otherwise.