I am trying to apply anomaly detection on count field.
Base query: index=test sourcetype=web source="test.log" WEB_URL="test"|timechart count by WEB_SOURCE_IP
-time IP 1 IP 2 . . IP N
timestamp Count Count Count
timestamp
Timestamp
But in the assistant for obvious reasons I am only getting option of choosing the IPs and _time in the fields to select dropdown. I need guidance on how can I approach here.
@PRIYANKA_1993 ..."But in the assistant for obvious reasons I am only getting option of choosing the IPs and _time in the fields to select dropdown"...
What is it that you want to do here which Assistant is not allowing?
If Assistant is letting you choose the field, you can use the Show SPL option with few fields and then convert the query as per your needs.
Have you tried using the default splunk anamoly commands, something like this -
index=test sourcetype=web source="test.log" WEB_URL="test"|timechart count by WEB_SOURCE_IP|anomalydetection
Or just this
index=test sourcetype=web source="test.log" WEB_URL="test"|index="_audit"| anomalies|table _raw unexpectedness