Splunk Search

anomalousvalue misuse or bug?

Path Finder

I ran the following:

source="/path/to/vpn_log" | anomalousvalue action=summary date_hour

Every event was normal (even after changing pthresh). I noticed the mean and stddev were all 0. The IsNum column is Yes as exepcted, but the UseNum column is No which seems odd.

Am I using this incorrectly (or expecting the wrong results)? Running 5.0.1. I didn't see any known bugs or see this in the changelog for 5.0.2.

Tags (1)
0 Karma
1 Solution

Path Finder

Found the issue. You have to have 100 or more events in the search before the mean and standard deviation will be calculated.

View solution in original post

0 Karma

Path Finder

Found the issue. You have to have 100 or more events in the search before the mean and standard deviation will be calculated.

View solution in original post

0 Karma