For Anomaly detection, on string field, which meth...

VS0909 · ‎09-01-2020

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest

VS0909 · ‎09-01-2020

@thambisettyThanks for the reply!

This mentions mostly for numeric fields, I am looking for Zscore or histogram for string(character) field.

For Anomaly detection, on string field, which method is better - Zscore or histogram? Please suggest!

thambisetty · ‎09-01-2020

z--score, you should apply standard deviation to see how the values are deviating. with out count of strings, I don't know how you calculate zscore, or histogram.

————————————
If this helps, give a like below.

thambisetty · ‎09-01-2020

https://conf.splunk.com/files/2019/recordings/FN1390.mp4

————————————
If this helps, give a like below.

For Anomaly detection, on string field, which method is better - Zscore or histogram?

count

fields

lookup

stats

subsearch

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Free Professional Services for .conf26 Attendees

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Join the Conversation

For Anomaly detection, on string field, which method is better - Zscore or histogram?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.