Turn on anomaly detection

Get alerts about abnormal fluctuations in your sensor data with anomaly detection. The Splunk Edge Hub OS detects deviations from standard data patterns using a k-Nearest Neighbour machine learning algorithm. This algorithm creates individual metric models after gathering data streams from the multiple Splunk Edge Hub sensors, defining normal behavior, and identifying different types of anomalies.

You can enable anomaly detection for a sensor in the Splunk Edge mobile app. If the Splunk Edge Hub OS detects an anomaly, it sends the anomaly event as an alert to your Splunk platform instance. You can then search for the anomaly metrics, use the anomaly in dashboards, or support alert configurations.

Prerequisites

Complete the steps at Installation and configuration overview for Splunk Edge Hub OS.

Turn on anomaly detection

Here's how to turn on anomaly detection.

1. In the Splunk Edge mobile app, select the Splunk Edge Hub you want to enable anomaly detection for.
2. Select the sensor that you want to turn on anomaly detection for.
3. Toggle on the Anomaly Detection switch.

You can also change the Upload Rate value to configure how often you want to send updates to your Splunk platform instance. This configuration affects the frequency that anomaly updates are sent.

Anomaly detection requires a training window before displaying significant results. This training window usually takes about a day.

When Splunk Edge Hub OS detects an outlier occurrence, it sends an anomaly metric to your Splunk platform instance in the designated index for anomalies. After the anomaly metric is ingested, you can use the metric in a various features, such as the following:

• Search for anomaly metrics in the Search and Reporting app. You can use the field type with the value anomaly-detector to filter the anomaly metric from other metrics in the index.
• View the Edge Hub Sensor Trends dashboard that ships as a sample dashboard in the Splunk App for Edge Hub and AR. The dashboard displays trends in the metric values and anomaly points detected during metric collection.
• Enable the sample alerts that ship with the Splunk App for Edge Hub and AR. You can set actions such as sending notifications to the Splunk Mobile app when the alerts are triggered.
  • See Send alerts and dashboards to Splunk Mobile users to learn how to send mobile notifications to the Splunk Mobile app.

Turn on anomaly detection alerts

Use Splunk Web to turn on anomaly detection alerts. See Set up anomaly alerts for Splunk Edge Hub OS in the Splunk Edge Hub OS: Install and Use Splunk App for Edge Hub and Splunk AR manual to learn more.