Splunk Search

Does the anomalies command work at all?

kundeng
Path Finder

Here is a simple example:
Server restarts at midnight, the anomalies command didn't really catch the drastic drop in event volumes.

I can't embed the image so here is the link:

i.imgur.com/a0nnbHK.png

Tags (1)

prelert
Path Finder

The 'anomalies' command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are trying to identify a significant deviation in event rate rather than an unusual event.

A technique for doing this is to create a statistical baseline of the typical event rate (allowing for periodicity in the data), and use this to compute the probability of the current event rate.

Pasting the same timechart command into 'QuickMode' in the Prelert app (https://apps.splunk.com/app/1306/) can achieve this and is straight forward to try out. Let me know if you need more detail?,The anomalies command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are interested in looking for significant deviations in event rates. A more appropriate method may be to create a baseline of 'normal' event rates and compute the probability of the current event rate given this baseline.

An example of how to do this is to paste the timechart search into 'QuickMode' in the prelert app (https://apps.splunk.com/app/1306/). This creates a statistical model of the event rate (count) allowing for changes in periodicity resulting in the anomalies where the probability of the event rate is low.

0 Karma

kundeng
Path Finder

Please take a look the image attached.

It's private data but as you can see:

Splunk version is the most current 6.1.1

The search before piping into anomalies command
Calculates timechart of a counter A

Anomalies command uses as the option: field=A labelonly=true

0 Karma

MuS
SplunkTrust
SplunkTrust

without providing any information about:

 splunk version used 
 sample events
 search used

nobody will be able to help or assist you ....

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...