Splunk Search

Difference between anomalies and anomalousvalue

cphair
Builder

Hi,

Can anyone explain the difference between anomalies and anomalousvalue? From the search reference, it looks like anomalies operates on a single field and is context-sensitive (i.e. looks at the surrounding X events to see if the current event is unusual), while anomalousvalue looks at the combination of all fields over the entire time range. If that's wrong, please correct me.

1 Solution

steveyz
Splunk Employee
Splunk Employee

anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.

View solution in original post

richcollier
Path Finder
0 Karma

steveyz
Splunk Employee
Splunk Employee

anomalousvalue actually only analyzes one field at a time, but it you can apply it to any arbitrary set of fields. anomalousvalue has several modes. In the summary mode, it will just emit an report of the various fields that exist and their behavior with regard to having values that may be anomalous.

steveyz
Splunk Employee
Splunk Employee

You would get a list of results that had either unusual hosts, unusual events, or both.

Rare is just the converse of top and is purely a reporting command. Rare doesn't necessarily mean anomalous if you you have a lot of rare values. anomalousvalue considers the distribution of values when deciding if something is anomalous or not. Also for numerical fields, anomalousvalue uses average and variance/stdev to determine what is anomalous.

Anomalousvalue does look at the whole event set. I'm actually not that familar with 'anomalies' so i'm not sure exactly what does not.

0 Karma

cphair
Builder

@steveyz -- not sure if you got a notification about my previous comment...

0 Karma

cphair
Builder

So if had data that had host and event fields, and I ran anomalousvalue action=filter host,event ... would I get a set of results that listed the unusual hosts, or the unusual events, or the rarest host/event combinations? For that matter, what's the difference between anomalous and rare?

Am I correct that anomalies looks at the immediate surrounding events and anomalousvalue looks at everything in the range?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...