For Anomaly detection, on string field, which meth...

VS0909 · ‎09-01-2020

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest

VS0909 · ‎09-01-2020

@thambisettyThanks for the reply!

This mentions mostly for numeric fields, I am looking for Zscore or histogram for string(character) field.

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest!

thambisetty · ‎09-01-2020

z--score, you should apply standard deviation to see how the values are deviating. with out count of strings, I don't know how you calculate zscore, or histogram.

————————————
If this helps, give a like below.

thambisetty · ‎09-01-2020

https://conf.splunk.com/files/2019/recordings/FN1390.mp4

————————————
If this helps, give a like below.

For Anomaly detection, on string field, which method is better - Zscore or histogram?

count

fields

lookup

stats

subsearch

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Rounding off the Splunk Dashboard Contest

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

Splunk Technical Support Is Moving to Cisco Support Tools

Join the Conversation

For Anomaly detection, on string field, which method is better - Zscore or histogram?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.