When using this package in Jupyter Notebook, I'm using Python to apply different models to the data based on whether it's during working hours or not. Although I'm using autoencoder as the main architectural framework, I'm taking this approach because the data follows different distributions under these two scenarios." When using this package in Jupyter Notebook, I'm using Python to apply different models to the data based on whether it's during working hours or not. Although I'm using autoencoder as the main architectural framework, I'm taking this approach because the data follows different distributions under these two scenarios." Are there any other better approaches ... View more

I want to use an autoencoder model in Splunk for anomaly detection. I have already built my own model, and I did not use a scaler during the process. However, I still encountered the following error. Here is my code:   I want to check the fields returned by my func in the search bar. What syntax can I use to verify this? this is my python code       def apply(model, df, param): X = df[param['feature_variables']].copy() # 1. 類型轉換 X = X.replace({True: 1, False: 0}) # 2. 處理特殊字符/缺失值 X = X.apply(pd.to_numeric, errors='coerce') # 將無法轉換的值設為NaN X = X.fillna(0) # 3. 類型統一 X = X.astype('float32').values """ 应用模型进行异常检测（无标准化） """ # X = df[param['feature_variables']].values # 重建预测 X_reconstructed = model.predict(X) # 计算重建误差 reconstruction_errors = np.mean(np.square(X - X_reconstructed), axis=1) # 异常阈值设置 threshold_percentile = param.get('options', {}).get('params', {}).get('threshold_percentile', 95) threshold = np.percentile(reconstruction_errors, threshold_percentile) # 构建结果 df_result = df.copy() df_result['reconstruction_error'] = reconstruction_errors filtered_errors_1 = df_result.loc[df_result['is_work'] == 1, 'reconstruction_error'] filtered_errors_0 = df_result.loc[df_result['is_work'] == 0, 'reconstruction_error'] threshold_1 = np.percentile(filtered_errors_1, threshold_percentile) if not filtered_errors_1.empty else np.nan threshold_0 = np.percentile(filtered_errors_0, threshold_percentile) if not filtered_errors_0.empty else np.nan df_result['threshold'] = np.where(df_result['is_work'] == 1, threshold_1, threshold_0) df_result['is_anomaly'] = (reconstruction_errors > threshold).astype(int) # 可选隐藏层特征 if param.get('options', {}).get('params', {}).get('return_hidden', False): intermediate_model = Model(inputs=model.inputs, outputs=model.layers[1].output) hidden = intermediate_model.predict(X) hidden_df = pd.DataFrame(hidden, columns=[f"hidden_{i}" for i in range(hidden.shape[1])]) df_result = pd.concat([df_result, hidden_df], axis=1) return df_result       I used apply to call this model, but I want to see the threshold field returned in df_result.       ... View more

我想使用 syslog-ng 將資料從通用轉寄器輸入到我的搜尋頭 我將使用 TCP，但我不知道哪裡出了問題，我無法在搜索頭中顯示我的數據 這是我的syslog-ng splunk.conf       template syslog { template("${DATE} ${HOST} ${MESSAGE}\n"); }; rewrite rewrite_stripping_priority { subst("^\<\\d+>", "", value(MESSAGE)); }; source src_udp_514 { udp(ip("0.0.0.0") so_rcvbuf(16777216) keep_timestamp(yes) flags(no-parse)); }; destination dest_tcp_10001 { tcp("127.0.0.1" port(10001) template("syslog")); }; filter f_linux_server { netmask(172.18.0.8/32) }; destination dest_tcp_10002 { tcp("127.0.0.1" port(10002) template("syslog")); }; filter f_linux_server2 { netmask(172.18.0.9/32) }; log { source(src_udp_514); rewrite(rewrite_stripping_priority); if (filter(f_linux_server)) { destination(dest_tcp_10001); } elif (filter(f_linux_server2)) { destination(dest_tcp_10002); }; };       i also already set tcp 10001 and 10002 on my universal forwarder       ... View more