Hello Splunk Community, I’m working in the Behavioral Profiling app to create an Anomaly Scoring Rule. In the Define Indicator Source step, I have successfully selected my Behavioral Indicator (e.g...
See more...
Hello Splunk Community, I’m working in the Behavioral Profiling app to create an Anomaly Scoring Rule. In the Define Indicator Source step, I have successfully selected my Behavioral Indicator (e.g., "Amount Transaction"), but the Scoring Field dropdown is disabled / showing a red mark, and I’m unable to select any value. Details: Behavioral Indicator: Amount Transaction Data is visible when I run the same SPL in Search & Reporting. Time Range: Last Day (also tried other ranges) Using the default fields from my dataset (contains account, amount, _time). The Scoring Field dropdown does not show any options. What I have tried: Verified the field exists in my data. Changed the Time Range to ensure data is available. Recreated the Behavioral Indicator. Question: What specific requirements or field types does the Scoring Field expect? Do I need to modify the Behavioral Indicator definition or SPL so that this dropdown is populated? Any guidance or examples would be greatly appreciated. Thanks in advance! The Data that I have provided for profiling is as follows : imestamp,account,amount 2025-08-11 11:25:56,ACC1001,2500 2025-08-11 11:25:56,ACC1001,3000 2025-08-11 11:25:56,ACC1001,5000 2025-08-11 11:25:56,ACC1002,1500 2025-08-11 11:25:56,ACC1002,2000 2025-08-11 11:25:56,ACC1003,8000 2025-08-11 11:25:56,ACC1003,4000 2025-08-11 11:25:56,ACC1004,12000 2025-08-11 11:25:56,ACC1005,600 2025-08-11 11:25:56,ACC1005,750 2025-08-11 11:25:56,ACC1006,5000 2025-08-11 11:25:56,ACC1006,7000