Splunk Search

How to apply anomaly command on timechart query?

PRIYANKA_1993
New Member

I am trying to apply anomaly detection on count field.

Base query: index=test sourcetype=web source="test.log" WEB_URL="test"|timechart count by WEB_SOURCE_IP

-time IP 1 IP 2 . . IP N
timestamp Count Count Count

timestamp

Timestamp

But in the assistant for obvious reasons I am only getting option of choosing the IPs and _time in the fields to select dropdown. I need guidance on how can I approach here.

0 Karma

niketn
Legend

@PRIYANKA_1993 ..."But in the assistant for obvious reasons I am only getting option of choosing the IPs and _time in the fields to select dropdown"...

What is it that you want to do here which Assistant is not allowing?

If Assistant is letting you choose the field, you can use the Show SPL option with few fields and then convert the query as per your needs.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Sukisen1981
Champion

Have you tried using the default splunk anamoly commands, something like this -

 index=test sourcetype=web source="test.log" WEB_URL="test"|timechart count by WEB_SOURCE_IP|anomalydetection

Or just this

index=test sourcetype=web source="test.log" WEB_URL="test"|index="_audit"| anomalies|table _raw unexpectedness

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...