Splunk Search

Learning to use anomalies?

passing
Explorer

The documentation has not been much help all I really want is to start learning how to use it. Every time I try to use one of the example searches (or at least a version specific to my logs) I get: "A separating field was not found. Carrying on without it" and no unexpectedness field is visible. Does anyone no how to fix this? Or alternatively, just a few searches good for familiarizing myself with the use of anomalies?

Here is the documentation just in case: http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Anomalies

fbl_itcs
Path Finder

Are you using "annomalies ... by field_name". Then the message tells you that there are some events without the field_name field I would guess.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Could you provide some examples of the searches you are performing or other specifics that might help us answer your question?

--
Jesse Trucks
Minister of Magic
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...