Hi,
Can anyone explain the difference between anomalies and anomalousvalue? From the search reference, it looks like anomalies operates on a single field and is context-sensitive (i.e. looks at t...
I ran the following:
source="/path/to/vpn_log" | anomalousvalue action=summary date_hour
Every event was normal (even after changing pthresh). I noticed the mean and stddev were all 0. The I...
I want to start out with: EventIdentifier=4624 | AnomalousValue "Workstation Name"
...but this search returns an error. What am I doing wrong here? It's like Splunk doesn't know what the "W...
I have a field called capacity. I want to enable anomaly detection whenever there is a change in value of capacity (increments or decrements). So, if capacity value for a source "A" is "10" at 7th de...
Hi team,
I m trying to find network traffic of a user and classify it as high or normal based on avg and stdev calculations
QUERY :
index="pan_logs" sourcetype="pan:traffic" user!=unknown | ...
I have a field called 'err_msg' this field contains a long line which consists of the error as well as the file name and other details surrounding that error. What I'm looking for is the ability to d...
I want to take a list of fields and show the stats displayed on the Selected fields sidebar in a table.
When we do a search, on the left side there is a Selected Fields section. When we click on ...
I got below warning: " 'anomalydetection' command: limit for values of field 'message' reached. Some values may have been truncated or ignored." 1) Does this means that some events are removed. Fo...
...ime the thread was published on? The thread also mentions the Anomalousvalue (http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Anomalousvalue ) and Rare (http://docs.splunk.com/D...
Hi,
I have started to learning machine learning concepts and trying to imply on Splunk tool. So, i tried to use anomaly and anomalydetection search commands but i couldn't understand how these com...