About the Splunk App for Anomaly Detection

The Splunk App for Anomaly Detection is a free app you can download from Splunkbase.

The Splunk App for Anomaly Detection finds anomalies in time-series datasets and provides an end-to-end workflow to manage and operationalize anomaly detection tasks. The app detects seasonal patterns and determines all of the optimal parameters automatically.

Using the app you can create anomaly detection jobs, run these jobs on a regular cadence, view SPL queries, and create alerts. The app works with any time-series dataset that can be ingested into the Splunk platform.

The app uses machine learning to detect seasonality in the data without user inputs, lowering the barriers to realizing value. The app also performs health diagnostics on the time-series to check whether the dataset is fit for anomaly detection.

Similar to other Splunk applications, the resources consumption of CPU and memory is commensurate with the size of the datasets that you use.

Splunk App for Anomaly Detection features

The following features are included with the Splunk App for Anomaly Detection:

• Data health check: A diagnostic "health check" automatically alerts the user to a variety of possible data quality issue
• Simple sensitivity adjustment: You can easily adjust the detection sensitivity with a simple +/- interface. More (or fewer) anomalies can be intelligently produced to fit your alerting preferences.
• Creation of a Search Processing Language (SPL) query for use elsewhere in the Splunk platform: When you create an anomaly detection job, the app writes an SPL query you can view and use to generate alerts based on the anomaly detection results.

Requirements for the Splunk App for Anomaly Detection

In order to successfully run the Splunk App for Anomaly Detection, the following is required:

• Splunk Enterprise 8.1.x or higher, or Splunk Cloud Platform.
• Installation of the correct version of the Python for Scientific Computing (PSC) add-on version 3.x or higher from Splunkbase.
  • Mac OS environment.
  • Windows 64-bit environment.
  • Linux 64-bit environment.
• Installation of the Splunk Machine Learning Toolkit (MLTK) app version 5.4.0 or higher from Splunkbase.