Splunk Search

Does the anomalies command work at all?

kundeng
Path Finder

Here is a simple example:
Server restarts at midnight, the anomalies command didn't really catch the drastic drop in event volumes.

I can't embed the image so here is the link:

i.imgur.com/a0nnbHK.png

Tags (1)

prelert
Path Finder

The 'anomalies' command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are trying to identify a significant deviation in event rate rather than an unusual event.

A technique for doing this is to create a statistical baseline of the typical event rate (allowing for periodicity in the data), and use this to compute the probability of the current event rate.

Pasting the same timechart command into 'QuickMode' in the Prelert app (https://apps.splunk.com/app/1306/) can achieve this and is straight forward to try out. Let me know if you need more detail?,The anomalies command can be effective in identifying the unexpectness of an event, but from your use case it looks like you are interested in looking for significant deviations in event rates. A more appropriate method may be to create a baseline of 'normal' event rates and compute the probability of the current event rate given this baseline.

An example of how to do this is to paste the timechart search into 'QuickMode' in the prelert app (https://apps.splunk.com/app/1306/). This creates a statistical model of the event rate (count) allowing for changes in periodicity resulting in the anomalies where the probability of the event rate is low.

0 Karma

kundeng
Path Finder

Please take a look the image attached.

It's private data but as you can see:

Splunk version is the most current 6.1.1

The search before piping into anomalies command
Calculates timechart of a counter A

Anomalies command uses as the option: field=A labelonly=true

0 Karma

MuS
SplunkTrust
SplunkTrust

without providing any information about:

 splunk version used 
 sample events
 search used

nobody will be able to help or assist you ....

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...