Re: For Anomaly detection, on string field, which ...

VS0909 · ‎09-01-2020

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest

VS0909 · ‎09-01-2020

@thambisettyThanks for the reply!

This mentions mostly for numeric fields, I am looking for Zscore or histogram for string(character) field.

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest!

thambisetty · ‎09-01-2020

z--score, you should apply standard deviation to see how the values are deviating. with out count of strings, I don't know how you calculate zscore, or histogram.

————————————
If this helps, give a like below.

thambisetty · ‎09-01-2020

https://conf.splunk.com/files/2019/recordings/FN1390.mp4

————————————
If this helps, give a like below.

For Anomaly detection, on string field, which method is better - Zscore or histogram?

count

fields

lookup

stats

subsearch

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Management Digest – September 2026

Federated Search for CloudWatch Unified Data Store Is Generally Available

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

For Anomaly detection, on string field, which method is better - Zscore or histogram?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.