Splunk Search

Difference between anomalies and anomalousvalue

cphair
Builder

Hi,

Can anyone explain the difference between anomalies and anomalousvalue? From the search reference, it looks like anomalies operates on a single field and is context-sensitive (i.e. looks at the surrounding X events to see if the current event is unusual), while anomalousvalue looks at the combination of all fields over the entire time range. If that's wrong, please correct me.

1 Solution

steveyz
Splunk Employee
Splunk Employee

anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.

View solution in original post

richcollier
Path Finder
0 Karma

steveyz
Splunk Employee
Splunk Employee

anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.

steveyz
Splunk Employee
Splunk Employee

You would get a list of results that had either unusual hosts, unusual events, or both.

Rare is just the converse of top and is purely a reporting command. Rare doesn't necessarily mean anomalous if you you have a lot of rare values. anomalousvalue considers the distribution of values when deciding if something is anomalous or not. Also for numerical fields, anomalousvalue uses average and variance/stdev to determine what is anomalous.

Anomalousvalue does look at the whole event set. I'm actually not that familar with 'anomalies' so i'm not sure exactly what does not.

0 Karma

cphair
Builder

@steveyz -- not sure if you got a notification about my previous comment...

0 Karma

cphair
Builder

So if had data that had host and event fields, and I ran anomalousvalue action=filter host,event ... would I get a set of results that listed the unusual hosts, or the unusual events, or the rarest host/event combinations? For that matter, what's the difference between anomalous and rare?

Am I correct that anomalies looks at the immediate surrounding events and anomalousvalue looks at everything in the range?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...