Splunk Search

Does the anomalies command work at all?

kundeng
Path Finder

Here is a simple example:
Server restarts at midnight, the anomalies command didn't really catch the drastic drop in event volumes.

I can't embed the image so here is the link:

i.imgur.com/a0nnbHK.png

Tags (1)

prelert
Path Finder

The 'anomalies' command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are trying to identify a significant deviation in event rate rather than an unusual event.

A technique for doing this is to create a statistical baseline of the typical event rate (allowing for periodicity in the data), and use this to compute the probability of the current event rate.

Pasting the same timechart command into 'QuickMode' in the Prelert app (https://apps.splunk.com/app/1306/) can achieve this and is straight forward to try out. Let me know if you need more detail?,The anomalies command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are interested in looking for significant deviations in event rates. A more appropriate method may be to create a baseline of 'normal' event rates and compute the probability of the current event rate given this baseline.

An example of how to do this is to paste the timechart search into 'QuickMode' in the prelert app (https://apps.splunk.com/app/1306/). This creates a statistical model of the event rate (count) allowing for changes in periodicity resulting in the anomalies where the probability of the event rate is low.

0 Karma

kundeng
Path Finder

Please take a look the image attached.

It's private data but as you can see:

Splunk version is the most current 6.1.1

The search before piping into anomalies command
Calculates timechart of a counter A

Anomalies command uses as the option: field=A labelonly=true

0 Karma

MuS
Legend

without providing any information about:

 splunk version used 
 sample events
 search used

nobody will be able to help or assist you ....

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...