Splunk Search
Highlighted

Difference between anomalies and anomalousvalue

Builder

Hi,

Can anyone explain the difference between anomalies and anomalousvalue? From the search reference, it looks like anomalies operates on a single field and is context-sensitive (i.e. looks at the surrounding X events to see if the current event is unusual), while anomalousvalue looks at the combination of all fields over the entire time range. If that's wrong, please correct me.

Highlighted

Re: Difference between anomalies and anomalousvalue

Splunk Employee
Splunk Employee

anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.

View solution in original post

Highlighted

Re: Difference between anomalies and anomalousvalue

Builder

So if had data that had host and event fields, and I ran anomalousvalue action=filter host,event ... would I get a set of results that listed the unusual hosts, or the unusual events, or the rarest host/event combinations? For that matter, what's the difference between anomalous and rare?

Am I correct that anomalies looks at the immediate surrounding events and anomalousvalue looks at everything in the range?

0 Karma
Highlighted

Re: Difference between anomalies and anomalousvalue

Builder

@steveyz -- not sure if you got a notification about my previous comment...

0 Karma
Highlighted

Re: Difference between anomalies and anomalousvalue

Splunk Employee
Splunk Employee

You would get a list of results that had either unusual hosts, unusual events, or both.

Rare is just the converse of top and is purely a reporting command. Rare doesn't necessarily mean anomalous if you you have a lot of rare values. anomalousvalue considers the distribution of values when deciding if something is anomalous or not. Also for numerical fields, anomalousvalue uses average and variance/stdev to determine what is anomalous.

Anomalousvalue does look at the whole event set. I'm actually not that familar with 'anomalies' so i'm not sure exactly what does not.

0 Karma
Highlighted

Re: Difference between anomalies and anomalousvalue

Path Finder
0 Karma