Splunk® Enterprise

Search Manual

Download manual as PDF

Download topic as PDF

About anomaly detection

This section describes anomaly detection. For a complete list of topics on detecting anomalies, finding and removing outliers, detecting patterns, and time series forecasting see About advanced statistics, in this manual.

Overview of anomaly detection

An anomaly is a deviation from the expected behavior of the system. An anomaly can be:

  • A single event
  • A sequence of events
  • A sequence of transactions
  • Complex patterns

Examples of common use cases for anomaly detection include:

Industry Use case example
IT Identifying a distributed denial of service (DDoS) attack from IP address ranges.
Marketing Rare but high-value customer purchase patterns.
Product Rare or previously unknown method of using a product that yields better results or yields results more efficiently than known methods.
Security Faster-than-human transactions. Detecting when transactions are being performed much more quickly by one user than by others. This could indicate a bot or an attempt to probe security measures.

Effective anomaly detection

To perform effective anomaly detection, put all of the data in one place. If you do not have your machine and business data in the same place, you cannot perform a comprehensive analysis.

Begin tracking IT and business performance metrics. Additionally, create a baseline data image which shows the current state of your system.

See also

About advanced statistics, Finding and removing outliers, Detecting anomalies

PREVIOUS
Commands for advanced statistics
  NEXT
Finding and removing outliers

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2, 6.6.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters