Can I use Splunk's anomaly detection in MLTK to enable ops folks to identify recent unusual log messages?

[tlevine]

I want our operations folks to be able to quickly see which unusual log messages have started showing up.

That is rather than wading through lots of messages that are typical, I want them to find the recent unusual ones.

Is this a job for splunk's anomaly detection in the MLTK?

thanks

[yuanliu]

Yes and no.  If you have mathematically defined what is "typical" and what is "unusual", MLTK can help you detect them.  You can experiment with various algorithms and parameters to do that.

To my knowledge, MLTK also has some clustering algorithms that can help separate "unusual" from "typical".  In all cases, you will need to first determine what is "unusual".  This usually calls for lots of domain knowledge.