Splunk Search

Outlier detection

Nils
New Member

Hi! 

I have a data set consisting of a csv-file with three columns with numerical data.

I have performed my own implementation that clusters the data set with K-means and then calculates outliers based on euclidean distance between data points and the cluster centroids. 

I wan't to perform the same kind of operation in Splunk but have not been successfull so far. 

I have tried local outlier factor, with the following query in search: 

source="dataset.csv" | fit LocalOutlierFactor 0,1,2 | search isOutlier="1.0"

However, the result from this search is very poor since very few outliers are detected. The data set is labeled making it easy to see correctly classified outliers. 

I have also tried with "Detect numeric outliers" from the machine learning toolkit but there, I can only chose one field to analyze and I have three fields. 

 

Is there an optimal solution to the problem of finding outliers in this type of dataset? 

 

Thanks in advance!

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...