Learning to use anomalies?

[passing]

The documentation has not been much help all I really want is to start learning how to use it. Every time I try to use one of the example searches (or at least a version specific to my logs) I get: "A separating field was not found. Carrying on without it" and no unexpectedness field is visible. Does anyone no how to fix this? Or alternatively, just a few searches good for familiarizing myself with the use of anomalies?

Here is the documentation just in case: http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Anomalies

[fbl_itcs]

Are you using "annomalies ... by field_name". Then the message tells you that there are some events without the field_name field I would guess.

[jtrucks]

Could you provide some examples of the searches you are performing or other specifics that might help us answer your question?