outlier
Description
This command is used to remove outliers, not detect them. It removes or truncates outlying numeric values in selected fields. If no fields are specified, then the outlier
command attempts to process all fields.
To identify outliers and create alerts for outliers, see finding and removing outliers in the Search Manual.
Use current Splunk machine learning (ML) tools to take advantage of the latest algorithms and get the most powerful results. See About the Splunk Machine Learning Toolkit in the Splunk Machine Learning Toolkit.
Syntax
outlier <outlier-options>... [<field-list>]
Optional arguments
- <outlier-options>
- Syntax: <action> | <mark> | <param> | <uselower>
- Description: Outlier options.
- <field-list>
- Syntax: <field> ...
- Description: A space-delimited list of field names.
Outlier options
- <action>
- Syntax: action=remove | transform
- Description: Specifies what to do with the outliers. The
remove
option removes events that containing the outlying numerical values. Thetransform
option truncates the outlying values to the threshold for outliers. Ifaction=transform
andmark=true
, prefixes the values with "000". - Abbreviations: The
remove
action can be shorted torm
. Thetransform
action can be shorted totf
. - Default: transform
- <mark>
- Syntax: mark=<bool>
- Description: If
action=transform
andmark=true
, prefixes the outlying values with "000". Ifaction=remove
, themark
argument has no effect. - Default: false
- <param>
- Syntax: param=<num>
- Description: Parameter controlling the threshold of outlier detection. An outlier is defined as a numerical value that is outside of
param
multiplied by the inter-quartile range (IQR). - Default: 2.5
- <uselower>
- Syntax: uselower=<bool>
- Description: Controls whether to look for outliers for values below the median in addition to above.
- Default: false
Usage
The outlier
command is a dataset processing command. See Command types.
Filtering is based on the inter-quartile range (IQR), which is computed from the difference between the 25th percentile and 75th percentile values of the numeric fields. If the value of a field in an event is less than (25th percentile) - param*IQR
or greater than (75th percentile) + param*IQR
, that field is transformed or that event is removed based on the action
parameter.
Examples
Example 1: For a timechart of webserver events, transform the outlying average CPU values.
404 host="webserver" | timechart avg(cpu_seconds) by host | outlier action=tf
Example 2: Remove all outlying numerical values.
... | outlier
See also
nomv | outputcsv |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1, 8.1.0, 8.1.10, 8.1.11, 8.1.12
Feedback submitted, thanks!