Does the anomalies command work at all?

[kundeng]

Here is a simple example:
Server restarts at midnight, the anomalies command didn't really catch the drastic drop in event volumes.

I can't embed the image so here is the link:

i.imgur.com/a0nnbHK.png

[prelert]

The 'anomalies' command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are trying to identify a significant deviation in event rate rather than an unusual event.

A technique for doing this is to create a statistical baseline of the typical event rate (allowing for periodicity in the data), and use this to compute the probability of the current event rate.

Pasting the same timechart command into 'QuickMode' in the Prelert app (https://apps.splunk.com/app/1306/) can achieve this and is straight forward to try out. Let me know if you need more detail?,The anomalies command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are interested in looking for significant deviations in event rates. A more appropriate method may be to create a baseline of 'normal' event rates and compute the probability of the current event rate given this baseline.

An example of how to do this is to paste the timechart search into 'QuickMode' in the prelert app (https://apps.splunk.com/app/1306/). This creates a statistical model of the event rate (count) allowing for changes in periodicity resulting in the anomalies where the probability of the event rate is low.

[kundeng]

Please take a look the image attached.

It's private data but as you can see:

Splunk version is the most current 6.1.1

The search before piping into anomalies command
Calculates timechart of a counter A

Anomalies command uses as the option: field=A labelonly=true

[MuS]

without providing any information about:

 splunk version used 
 sample events
 search used

nobody will be able to help or assist you ....