Hi! I used the "Cluster Behavior by App Usage" example in the Clustering Numeric Fields workflow within the Splunk MLTK Showcase. It produces the cluster visualization shown below. Can you help me understand the meaning of this visualization or recommend resources for understanding this visualization? How do I know which fields are clustered by looking at this? I understand the coloring has something to do with it, but there are multiple plots, and I would love some help trying to understand what this means. Thank you so much!
... View more
I'm using the Machine Learning Toolkit (MLTK) to detect outliers. It envelopes my line chart between the upper and lower bounds and uses these to determine whether or not there are outliers. If I reduce the number of data points by zooming in on a particular time period of my line chart, the number of outliers increases. I know that the number of data points changes the numbers in the math, and that we have to tune our model to our needs, but do you have any advice on how to tune this, or how to determine what a large enough sample is so that I don't miss any outliers? The major outliers are always obvious, but how can I make my outlier detection more "capable" at detecting outliers that are not so obvious (since they're not as drastically deviated as some other outliers are)?
... View more