Splunk has hundreds of apps that extend its core capabilities.
The Machine Learning Toolkit App delivers new ML specific search commands, visualizations,
and other tools for performing machine learning to your Splunk data.
In addition, the application has ML Assistants that guide you through the process of building
custom models and operationalizing them on the Splunk Platform.
Let’s walk through the “Detect Numeric Outliers” Assistant.
This assistant identifies values that are statistically dissimilar from previous values,
which could indicate that something interesting, unusual, or possibly bad has happened.
Note that most of the input and output panels in this assistant have tooltips, giving us
more information about the particular panel.
Hover over a panel title or field label to reveal the tooltip.
Here we are trying to alert the administrator of a power plant whenever the humidity deviates
significantly from its typical range.
So that it is set back to its original state before it affects the generation of output
energy.
Using the search bar, we first load the Power plant dataset, packaged with the app.
After clicking the search button, we get the “Raw Data Preview” panel below, which
shows the fields in the dataset.
This assistant helps us find outliers in a single field , we will select humidity.
Next, we need to choose a Threshold Method based on the distribution of the data and
how sensitive you want to be to outliers.
Select Standard Deviation if your data is normally distributed
and you don't mind outliers having a significant impact on the outlier threshold. Otherwise,
if you want to incorporate more robustness to outliers, try the other methods. We will
use Standard Deviation method.
Next, we specify a threshold multiplier. Larger multiplier, increases the bandwidth of outlier
envelope.
We have an option to set a value for the sliding window, so you can specify the number of values
which will be used to compute each slice of the outlier envelope. Otherwise, if you don't
specify a sliding window, the envelope is computed using the entire dataset at once,
therefore creating a static outlier envelope. We won’t be setting the sliding window value
as we just need a static outlier envelope for humidity.
After clicking the Detect Outliers button, Outliers are identified that fell outside
the confidence bounds. These outliers are then presented using time series visualizations
and other tabular formats which are generated automatically.
The Outlier(s) panel which shows us the no. of outliers detected across our events, which
is 4 in this case, note that we can increase no. of outliers by decreasing the Threshold
Multiplier. We also have the ‘Total Events’ panel which shows the total no. of events
examined.
Next, we have the visualization of our humidity field. Anything outside the upper and lower
bound envelope are considered outliers as shown in the visualization here. Lastly, we
have a table showing us our humidity field, lower bound and upper bound of outlier envelope
and lastly the binary field ‘is Outlier’ where 1 means it is Outlier and 0 means it
is not. Using this table, we can get the exact amount by which the outlier was above or below
the envelope’s threshold.
Further, we can setup alerts for these outliers and report them to the Administrator of the
power plant, so that the necessary steps could be taken as soon as possible.
On the “Load Existing Settings” tab we can compare different setups used for detecting
outliers using statistics such as Number of Outliers, Threshold Methods, Threshold Multiplier
etc. and reload the one that worked best. We can also apply our configuration to new
data. These assistants not only walk you through the steps required to setup an outlier algorithm,
but all of these tools can be reused and provide a variety of options for operationalizing.
You can view the SPL commands used at every step, create alerts based on the output generated
or use one of the validation panels on your own dashboard.
To learn more about the Machine Learning Toolkit, including the other Assistants, browse through
our ML videos.