Difference between anomalies and anomalousvalue

[cphair]

Hi,

Can anyone explain the difference between anomalies and anomalousvalue? From the search reference, it looks like anomalies operates on a single field and is context-sensitive (i.e. looks at the surrounding X events to see if the current event is unusual), while anomalousvalue looks at the combination of all fields over the entire time range. If that's wrong, please correct me.

[richcollier]

Perhaps someone might find this useful:

http://www.prelert.com/blog/anomaly-detective-vs-splunks-anomalies-command-what-is-the-difference/

[steveyz · Accepted solution]

anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.

[steveyz]

You would get a list of results that had either unusual hosts, unusual events, or both.

Rare is just the converse of top and is purely a reporting command. Rare doesn't necessarily mean anomalous if you you have a lot of rare values. anomalousvalue considers the distribution of values when deciding if something is anomalous or not. Also for numerical fields, anomalousvalue uses average and variance/stdev to determine what is anomalous.

Anomalousvalue does look at the whole event set. I'm actually not that familar with 'anomalies' so i'm not sure exactly what does not.

[cphair]

@steveyz -- not sure if you got a notification about my previous comment...

[cphair]

So if had data that had host and event fields, and I ran anomalousvalue action=filter host,event ... would I get a set of results that listed the unusual hosts, or the unusual events, or the rarest host/event combinations? For that matter, what's the difference between anomalous and rare?

Am I correct that anomalies looks at the immediate surrounding events and anomalousvalue looks at everything in the range?