Which anomaly detection algorithm fulfills the paired monitoring requirement?

Question

Options

• ADetection algorithm: Trending anomaly detection
• BDetection algorithm: Entity cohesion anomaly detection
• CDetection algorithm: Trending anomaly detection
• DDetection algorithm: Entity cohesion anomaly detection

• A
  2% (1)
• B
  91% (40)
• C
  5% (2)
• D
  2% (1)

Explanation

Splunk ITSI offers two built in anomaly detection algorithms: Trending and Entity Cohesion. The Trending algorithm works on the aggregate KPI series, comparing recent KPI behavior with its historical pattern to detect unusual trending patterns over time. It does not evaluate behavior across separate entities within the KPI split -- it simply looks at deviations from historical trends in the combined KPI values. On the other hand, the Entity Cohesion algorithm is specifically designed to detect when entities that are expected to behave similarly begin to diverge in behavior. When a KPI is split by entity (for example, multiple servers, locations, or service tiers), Entity Cohesion normalizes each entity's time series and compares them against each other. If one entity's pattern differs significantly from the group's patterns, it is flagged as an anomaly. This matches the "paired monitoring requirement" of producing an alert when one entity in the KPI is not behaving similarly to the other entities.

No community discussion yet for this question.