Anomaly detection

Patent metadata

Field	Value
Publication number	US-2016103838-A1
Application number	US-201514859248-A
Country	US
Kind code	A1
Filing date	Sep 18, 2015
Priority date	Oct 9, 2014
Publication date	Apr 14, 2016
Grant date	—

Abstract

Techniques are disclosed for anomaly detection. A search query can be executed over a period of time to produce values for a key performance indicator (KPI), the search query defining the KPI and deriving a value indicative of the performance of a service at a point in time or during a period of time, the value derived from machine data pertaining to one or more entities that provide the service. A graphical user interface (GUI) enabling a user to indicate a sensitivity setting can be displayed. A user input indicating the sensitivity setting can be received via the GUI. Zero or more of the values as anomalies can be identified in consideration of the sensitivity setting indicated by the user input. A GUI including information related to the values identified as anomalies can be d

First claim

What is claimed is:

1 . A method comprising:
executing a search query over a period of time to produce values for a key performance indicator (KPI), the search query defining the KPI and deriving a value indicative of the performance of a service at a point in time or during a period of time, the value derived from machine data pertaining to one or more entities that provide the service; causing for display a graphical user interface (GUI) enabling a user to indicate a sensitivity setting; receiving, via the GUI, user input indicating the sensitivity setting; identifying zero or more of the values as anomalies based on the sensitivity setting indicated by the user input; and causing for display information related to the values identified as anomalies; wherein the method is performed by a computer system comprising one or more processors.

2 . The method of claim 1 , wherein the search query is repeatedly executed over the period of time.

3 . The method of claim 1 , wherein the search query is executed one or more times over the period of time.

4 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value.

5 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value.

6 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range of error values.

7 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range of error values, wherein the sensitivity setting is associated with the range.

8 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining a position of the error value in a range of error values, wherein the sensitivity setting defines a portion of the range and the position of the error value within the sensitivity setting portion of the range identifies the one of the values as an anomaly.

9 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining a position of the error value in a range of error values, wherein the sensitivity setting defines a portion of the range and the position of the error values within the sensitivity setting portion of the range identifies the one of the values as an anomaly, the portion being less than 10% at or near an end of the range.

10 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining a position of the error value in a range of error values, wherein the sensitivity setting defines a portion of the range and the position of the error values within the sensitivity setting portion of the range identifies the one of the values as an anomaly, the portion being less than 1% at or near an end of the range.

11 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range, wherein the range is a quantile range.

12 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range, wherein the range is a quantile range represented as a digest of error values determined over training data.

13 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range, wherein the range is a quantile range represented as a digest of error values determined over training data, the training data comprising a plurality of historic KPI values.

14 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range, wherein the range is a quantile range represented as a digest of error values determined over training data, the training data comprising a plurality of historic KPI values computed with respect to a plurality of entities that provide the service.

15 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range, wherein the range is a quantile range represented as a digest of error values determined over training data, the training data comprising a plurality of simulated KPI values.

16 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range, wherein the range is a quantile range represented as a digest of error values determined over training data, the training data comprising a plurality of example KPI values.

17 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the comparing including determining an error value and determining the position of the error value in a range, wherein the range is a quantile range represented as a digest of error values determined over training data, the training data comprising a plurality of values associated with one or more other KPIs.

18 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the predicted value based at least in part on one or more values for the KPI that immediately precede the predicted value.

19 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the predicted value based at least in part on a time series forecasting calculation and one or more values for the KPI that immediately precede the predicted value.

20 . The method of claim 1 , wherein identifying zero or more of the values as anomalies comprises comparing one of the values against a predicted value, the predicted value based at least in part on a frequency domain calculation and one or more values for the KPI that immediately precede the predicted value.

21 . The method of claim 1 ,

Assignees

• Splunk Inc

Inventors

• Sainani Manish
• Oliner Adam Jamison
• Leverich Jacob Barton
• Alekseyev Leonid
• Maheshwari Sonal Barton

Classifications

• H04L41/5045

  Making service definitions prior to deployment · CPC title

• H04L41/5032

  Generating service level reports · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title

• G06F3/0488 Primary

  using a touch-screen or digitiser, e.g. input of commands through traced gestures · CPC title

• G06F17/3053 Primary

  Physics · mapped topic